基于动态循环信息熵的密码函数筛选技术

Technique of cryptographic function filtration based on dynamic loop information entropy

二进制代码中的密码算法识别与筛选对于恶意软件分析、密码算法应用安全性验证有着重要意义。分析了密码函数代码实现中内存数据操作特征和基本块循环结构特征,根据二进制数据的信息熵理论,实验验证了密码算法内存操作数据的高熵值特性,构建了基于动态循环信息熵的密码函数筛选模型,并采用动静结合的方法重构基本块循环中的动态读写内存数据。测试结果表明了筛选模型的可靠性和准确性。

For malware analysis and cipher application security validating,identification and filtration of cryptographic function from binary code has great significance.The memory operation and basic block loop characters were analyzed from cryptographic functions.According to the theory of binary data＇s information entropy,the characteristic of high-entropy of cryptographic algorithms was verified,a cryptographic functions filtration model was constructed based on dynamic loop entropy,and the hybrid （dynamic and static） method was adopted to reconstruct dynamic memory data in basic block loop.The experimental result shows that the filtration model has reliability and veracity.