A block cipher algorithm identification scheme based on hybrid k-nearest neighbor and random forest algorithm.

Area of Science:

• Computer Science
• Cryptography
• Machine Learning

Background:

• Cryptographic algorithm identification is crucial for cryptanalysis.
• Existing methods may lack sufficient accuracy in identifying encryption algorithms.
• The need for robust identification schemes in ciphertext-only scenarios is growing.

Purpose of the Study:

• To propose a novel ensemble learning model, hybrid k-nearest neighbor and random forest (HKNNRF), for enhanced cryptographic algorithm identification.
• To develop and evaluate a block cipher algorithm identification scheme using the HKNNRF model.
• To improve the accuracy of identifying encryption algorithms in ciphertext-only scenarios.

Main Methods:

• Utilizing NIST randomness test methods for ciphertext feature extraction.
• Implementing an ensemble learning approach combining k-nearest neighbor (KNN) and random forest (RF) algorithms.
• Conducting binary-classification and five-classification experiments on block cipher algorithms.

Main Results:

• The HKNNRF model achieved higher classification accuracy compared to baseline models like support vector machine (SVM), KNN, and RF.
• Average binary-classification identification accuracy reached 69.5%, outperforming SVM (56.5%), KNN (57%), and RF (59.5%) by significant margins.
• Five-classification identification accuracy reached 34%, surpassing KNN (21%), RF (22%), and SVM (23%).

Conclusions:

• The proposed HKNNRF model demonstrates superior performance in cryptographic algorithm identification.
• Ensemble learning, specifically the HKNNRF approach, offers a promising direction for improving cryptanalysis accuracy.
• The developed scheme is effective for identifying block cipher algorithms even in ciphertext-only conditions.