A Method of Multiple Encryption and Sectional Encryption Protocol Reverse Engineering

Protocol Reverse Engineering (PRE) is of great significance to the research of cyber security and it is helpful to understand protocol specifications. There has been many researches on PRE but most of them need additional manual analysis, which is not available for private and unknown protocols. We propose a protocol state analysis and annotation method, which extracts the feature information of binary-based protocol data through an auto-encoder model. Moreover, density-based clustering algorithm is only used to distinguish protocol types in existing studies, we propose an improved algorithm and apply it to protocol state analysis. Finally, we apply alignment algorithm to get state information and do annotation. We run simulation to verify the effectiveness of proposed method and prove its feasibility in private and unknown protocols. The results of clustering algorithms are compared to show the improvement. Then the application of proposed method is summarized based on the simulation results, which provides a novel idea for the protocol analysis.

Dynamic taint analysis (DTA) is to analyze execution paths that an attacker may use to exploit a system. Dynamic taint analysis is a method to analyze executable files by tracing information flow without source code. DTA marks certain inputs to program as tainted, and then propagates values operated with tainted inputs. Due to the increased popularity of dynamic taint analysis, there have been a few recent research approaches to provide a generalized tainting infrastructure. In this paper, we introduce some approaches of dynamic taint analysis, and analyze their approaches. Lam and Chiueh's approach proposed a method that instruments code to perform taint marking and propagation. DYTAN considers three dimensions: taint source, propagation policies, taint sink. These dimensions make DYTAN to be more general framework for dynamic taint analysis. DTA++ proposes an idea to vanilla dynamic taint analysis that propagates additional taints along with targeted control dependencies. Control dependency causes results of taint analysis to have decreased accuracies. To improve accuracies, DTA++ showed that data transformation containing implicit flows should propagate properly to avoid under-tainting.

The RC-5 algorithm is an algorithm with the encryption method using the symmetric method and processing in the form of a cipher block, the same keywords are used for the encryption and decryption processes. The testing and analysis phase consists of a). Testing the execution time of the key generation process (set up key) b). Testing the success of the encryption and decryption process on the client-server integration method c). Testing the success of the encryption and decryption process using the file operation method d). Comparison of overhead/file size before and after passing through the system. The testing phase and execution time analysis are carried out when using the file operation method where the test will be divided into 3 parts, namely the execution time for the key setup process, the encryption process, and the decryption process. Testing the success of the encryption and decryption process on the client-server integration method is divided into 2 parts, namely testing the encryption process and the decryption process. In testing the encryption process, the characters that will be sent to the server will be encrypted first with a key to becoming a ciphertext in the form of integer data. The test results obtained are 1). The execution time for key generation (set up key) is very fast, around 9-10 ns. 2). In the encryption and decryption process, the execution time depends on the size of the plaintext file. The larger the plaintext file size, the longer the execution time. Where for a file with a size of 1 kb requires an execution time of 50.6 ms in the encryption process. 3). There is no difference between the size of the file before entering encryption and after decryption. Where for files with a size of 500 bytes before entering the encryption process, a file of 500 bytes will be generated from the decryption process.

In this paper, we proposed a tool framework of static analyzer for taint analysis of binary executable file. Dynamic taint analysis is becoming principal technique in security analysis. In particular, proposed system focuses on tracing a dynamic taint analysis. Moreover, most existing approaches are focused on data-flow based tainting. The modules of this paper use two kinds of input file type which are taint_trace file and binary executable file. Proposed system analyzes the result of dynamic taint analysis and makes control flow graph. Our proposed system is divided by three modules; taint reader, crash analyzer and code tracker. Trace reader converts trace file into readable/traceable information for a manual analyzer. Crash analyzer find out a vulnerability that is a causative factor in accrued crash. Code tracker supports a variety of binary executable file analysis. In this paper, we suggest a tool framework for dynamic taint analysis.

As an important program analysis method, taint analysis technology has been widely used in the field of vulnerability detection. However, the existing dynamic taint analysis needs to design instruction-by-instruction taint propagation rules, which is expensive and has a high false positive rate for identifying the implicit control flow of the target program. In view of the above problems, this paper proposes a dynamic taint analysis method nnTaint based on neural network for the existing taint-guided fuzzing technology, which has the characteristics of low cost and low false positives. Comparing nnTaint with the existing taint analysis tools, the operation efficiency is improved by 10.9%-18.8% compared with the traditional taint analysis, which reduces the cost of the existing dynamic taint analysis technology to a certain extent. On the LAVA-M testing datasets and GNU binutils program, nnTaint improves the edge coverage by 4.7%-16% compared with the existing taint-guided fuzzing tools, effectively improving the implicit control flow recognition accuracy of the existing dynamic taint analysis. The results show that nnTaint can improve the efficiency and accuracy of existing dynamic taint analysis tools.

We present an approach of using methods of database reverse engineering and data transformation in determining the multiplicities of associations in object-oriented analysis and modeling (OOAM). OOAM methodology is being used more and more in the development for IT applications of larger sizes. Creating correct object models is becoming important for ensuring that the design for the application is sound. Determining multiplicities of associations among object classes is a key part of creating the object model. The proposed approach is useful for information technology (IT) projects that migrate or integrate old database applications to new database applications. Many IT projects of large scale nowadays are of this type, because companies want to preserve as much as possible the capitals that they invested for old database applications. Many IT projects of large scale more or less involve with migrating or integrating some old database applications.

In recent years, software vulnerabilities are one of the main causes of security incidents in computer systems. Dynamic taint analysis is an efficient method to track the flow of sensitive information for soft vulnerability mining. In this paper, we present the method for dynamic taint analysis with control dependent is to tracking sensitive information. And finally, the simulation results are proposed to show the correctness of the proposed methods.

Reverse engineering of agnostic industrial control protocols (ICPs) based on traffic traces is significant for the security analysis of industrial control systems. Field semantics deduction is an essential step in protocol reverse engineering following the discovery of the message field. Most existing methods rely on knowledge-based analysis for specific fields of common protocols, which require too numerous assumptions and lack semantic knowledge about ICPs. In this paper, we propose a new concept, pattern series, and design the first classification framework for inferring the semantic types of unknown ICPs. Specifically, we first present the definition of pattern series and design the field pattern series generation algorithm for building training data, then develop a field semantics classification model to learn and apply semantic features from known protocols to predict semantic types in unknown protocols. Lastly, we implement a probability-maximizing selection algorithm to obtain optimal semantic types. We demonstrate the effectiveness of the proposed method through extensive experiments with five popular ICPs, including their mixed protocols. Evaluations show that our approach significantly outperforms baseline methods in field semantic recognition, achieving ≥90.8% F1-score.

Unsupervised field segmentation of unknown protocol messages

Encrypted network data classification has received considerable attention in the industry and research communities for a long time. However, the emergence of new private applications and encryption protocols has brought more new challenges. The primary task of classification is to determine whether the sample is encrypted. When the specification of private protocol is unpublished, only the whole sample can be processed, and thus the unencrypted field which coexists with the encrypted field will seriously lower the classification effect. To tackle this problem, an algorithm based on data reconstruction and moment eigenvector is proposed, which can not only estimate the encryption result but also locate the encrypted field in each data sample. In the algorithm, the encryption probability sequence is calculated firstly by data reconstruction and CNN (Convolutional Neural Network) model transfer. Then, based on the derivative of the encryption probability sequence, the suspected encrypted field set is generated. Finally, encrypted field matching is performed based on the similarity of the four-dimensional moment eigenvector, and thus the possible encrypted field of each sample is obtained. The proposed algorithm achieved a recall rate of 93% and a precision rate of 72% in an experiment of distinguishing the encrypted/unencrypted ones of complex data. The forward coverage, reverse coverage, and F1 value in identifying encrypted field reached 89%, 90%, and 90%, respectively. Compared with the encrypted field matching methods based on the K-Nearest Neighbor algorithm, Dynamic Time Warping, Runs test, and Frequency test, the method proposed in this paper exhibited salient advantages.

With the rapid development of computer network technology, information security has attracted increasing attention. Due to the characteristics of multi-dimensional operation and parallel processing capability, optical image encryption techniques have been receiving more and more attention. Since the well-known double random phase encoding technique was proposed, many other methods based on optical information processing means such as the use of optical transform, interference, and polarized light encoding, have been proposed for optical image encryption. However, recent researches have demonstrated that traditional optical encryption techniques are symmetric cryptosystems, in which decryption keys are identical to encryption keys and they have been found to be vulnerable to different types of attacks, such as known plaintext and chosen plaintext attacks. To overcome this shortcoming, asymmetric cryptosystems based on nonlinear phase-truncation techniques and phase retrieval algorithm have been proposed. Asymmetric cryptosystem is a cryptographic system in which encryption keys are different from decryption keys. The encryption keys are used as public keys which are disseminated widely, and the decryption keys are used as private keys which are known only to the authorized users. So, asymmetric cryptosystem can offer a higher-level security than symmetric cryptosystem. However, asymmetric cryptosystems based on phase retrieval algorithms require a lot of computational time, and asymmetric cryptosystems based on phase-truncated Fourier transforms have been found to be vulnerable to special attack. Therefore, in this paper, a novel asymmetric image encryption method is proposed by using the gyrator transform and vector operation. The original image is encrypted into two phase masks with vector operation. One is a random phase mask and the other is a phase mask related to the original image. In the encryption process, the random phase mask is used as a phase key and the other phase mask is transformed by gyrator transform. The transform result is performed by Fourier transform after being modulated by a phase distribution. The ciphertext is the amplitude of the above result. Compared with previous encryption schemes, the suggested method has two advantages. Firstly, we have proposed a new asymmetric encryption method based on the gyrator transform and vector operation. The decryption process is different from the encryption process. The gyrator transform and Fourier transform are used in the encryption process, while only the inverse operation of Fourier transform is employed in the decryption process. In addition, the decryption keys produced in the encryption process are different from the encryption keys. Therefore, the proposed scheme has high resistance against the conventional attacks. Secondly, the encrypted result is real-valued, which is convenient for display, transmission and storage.Numerical simulations illustrate the feasibility and effectiveness of the proposed encryption scheme.

In the present work the authors have introduced a new advanced symmetric key cryptographic method called NJJSAA. The authors introduced new bit manipulation method for data encryption and decryption of any file. Nath et al already developed some symmetric key methods[1,2,3,4] where they have used some randomized key matrix for encryption and decryption methods. In the present work the authors have used a bit manipulation method which include bit exchange, right shift and XOR operation on the incoming bits. To exchange bits the authors used a randomized key matrix of size (16x16) using the method developed by Nath et al(1). The present method allows the multiple encryption and multiple decryption. To initiate the encryption process a user has to enter a text-key which may be maximum of 16 characters long. From the text-key the authors have calculated randomization number and the encryption number. The method used was developed by Nath et al(1). A slight change in the text-key will change the randomization number and the encryption number quite a lot. Multiple encryption using bit exchange, bit right shift and XOR operations makes the system very secured. The present method is a block cipher method and it can be applied to encrypt data in sensor network or in mobile network. The advantage of the present method is that one can apply this method on top of any other standard algorithm such as DES, AES or RSA. The method is suitable to encrypt any large or small file. There is a scope to further enhance the present method of encryption.

The paper proposes a fuzzy processing method combined with dynamic information from the level of system program in industrial control protocol realization. The paper first expounds the theory of dynamic taint analysis and then gives the definition of dynamic information required and, proposes the fuzzy test method combined with dynamic information. The method proposed tracks program execution, finds the input fields affecting conditional branches through the dynamic taint analysis, and captures the dependence relationship of conditional branches to guide test case grammar generation pertinently, thus increasing the opportunity of executing codes on the deep level. The results of comparison experiment prove that the method improves the validity of test cases and the coverage rate of codes to some extent, and also increases the probability of finding the anomalies in protocol realization greatly.

In this book, we sought to capture the intrinsic natures in malicious behaviors, in order to build more effective automatic malware analysis systems. We proposed TEMU as a dynamic binary analysis platform. Then on top of TEMU, we proposed and built a series of novel techniques for automatic malware analysis, including Renovo, Panorama, HookFinder, and MineSweeper, for detecting and analyzing various aspects of malware. Since these techniques capture intrinsic characteristics of malware, they are well suited for dealing with new malware samples and attack mechanisms. We also systematically discussed several fundamental limitations in our proposed techniques.More concretely, we pointed out that although our analysis platform is better suited for analyzing malicious code than the other conventional ones (e.g., debugger and disassembler), malware authors may still find ways to detect and evade it. Moreover, an open problem for dynamic analysis lies in its limited test coverage. Finally, as a core analysis technique, dynamic taint analysis has several limitations, including taint explosion and implicit information flow. Such discussions shed light on future directions for automatic malware analysis.KeywordsAutomated Malware AnalysisTaint AnalysisImplicit Information flowCore Analysis TechniquesMalware SamplesThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Technological advances have given rise to the need for data protection, especially digital images, which are vulnerable to misuse. This research proposes a super encryption method that combines two cryptographic algorithms, namely Rabin Cryptosystem and Paillier Cryptosystem, to increase digital image security. Rabin's algorithm does not have homomorphism, so it is vulnerable to factorization attacks if the prime numbers used are too small. Meanwhile, the Paillier algorithm has homomorphism properties which allow arithmetic operations to be carried out directly on the ciphertext without decryption. By combining these two algorithms, this research aims to create a stronger and more efficient encryption method, and analyze its performance in terms of computational efficiency and complexity. It is hoped that the research results can improve the security and privacy of digital data, especially in the context of digital images.