Cryptovirological augmentations present an immediate, incomparable threat. Over the last decade, the substantial proliferation of crypto-ransomware has had widespread consequences for consumers and organisations alike. Established preventive measures perform well, however, the problem has not ceased. Reverse engineering potentially malicious software is a cumbersome task due to platform eccentricities and obfuscated transmutation mechanisms, hence requiring smarter, more efficient detection strategies. The following manuscript presents a novel approach for the classification of cryptographic primitives in compiled binary executables using deep learning. The model blueprint, a Dynamic Convolutional Neural Network (DCNN), is fittingly configured to learn from variable-length control flow diagnostics output from a dynamic trace. To rival the size and variability of equivalent datasets, and to adequately train our model without risking adverse exposure, a methodology for the procedural generation of synthetic cryptographic binaries is defined, using core primitives from OpenSSL with multivariate obfuscation, to draw a vastly scalable distribution. The library, CryptoKnight, rendered an algorithmic pool of AES, RC4, Blowfish, MD5 and RSA to synthesise combinable variants which automatically fed into its core model. Converging at 96% accuracy, CryptoKnight was successfully able to classify the sample pool with minimal loss and correctly identified the algorithm in a real-world crypto-ransomware application


    Access

    Download


    Export, share and cite



    Title :

    CryptoKnight:generating and modelling compiled cryptographic primitives


    Contributors:

    Publication date :

    2018-09-10


    Remarks:

    Hill , G & Bellekens , X 2018 , ' CryptoKnight : generating and modelling compiled cryptographic primitives ' , Information (Switzerland) , vol. 9 , no. 9 . https://doi.org/10.3390/info9090231



    Type of media :

    Article (Journal)


    Type of material :

    Electronic Resource


    Language :

    English



    Classification :

    DDC:    629



    Extracting Geometric Primitives

    Roth, G. / Levine, M. D. | British Library Online Contents | 1993


    Conditional Neural Movement Primitives

    M. Yunus Seker / Mert Imre / Justus Piater et al. | BASE | 2019

    Free access

    Shape using volumetric primitives

    Munck-Fairwood, R. C. / Du, L. | British Library Online Contents | 1993


    Human Integration of Shape Primitives

    Dudek, G. / Arguin, M. / Bub, D. et al. | British Library Conference Proceedings | 1994


    Trajectory generation using motion primitives

    SHECKELLS MATTHEW / CALDWELL TIMOTHY / KOBILAROV MARIN | European Patent Office | 2019

    Free access