Plaintext Structure Vulnerability: Robust Cipher Identification via a Distributional Randomness Fingerprint Feature Extractor

2025-11-11

AI Summary

To address the degradation of classifier generalizability in encrypted traffic classification caused by plaintext distribution shift, this paper proposes a ciphertext fingerprinting method that does not rely on end-to-end learning. The core innovation lies in abandoning implicit dependence on plaintext structure and instead quantifying ciphertext randomness via multidimensional statistical tests—including chi-square, runs, and spectral analysis—and modeling its frequency distribution patterns to construct algorithm-specific “distributional randomness fingerprints.” This framework significantly enhances cross-domain robustness: it achieves an AUC > 0.98 on the Canterbury Corpus; maintains an AUC > 0.90 under cross-dataset evaluation and under purely random plaintext conditions—demonstrating strong generalizability and stability.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

Modern encryption algorithms form the foundation of digital security. However, the widespread use of encryption algorithms results in significant challenges for network defenders in identifying which specific algorithms are being employed. More importantly, we find that when the plaintext distribution of test data departs from the training data, the performance of classifiers often declines significantly. This issue exposes the feature extractor's hidden dependency on plaintext features. To reduce this dependency, we adopt a method that does not learn end-to-end from ciphertext bytes. Specifically, this method is based on a set of statistical tests to compute the randomness feature of the ciphertext, and then uses the frequency distribution pattern of this feature to construct the algorithms'respective fingerprints. The experimental results demonstrate that our method achieves high discriminative performance (e.g., AUC>0.98) in the Canterbury Corpus dataset, which contains a diverse set of data types. Furthermore, in our cross-domain evaluation, baseline models'performance degrades significantly when tested on data with a reduced proportion of structured plaintext. In sharp contrast, our method demonstrates high robustness: performance degradation is minimal when transferring between different structured domains, and even on the most challenging purely random dataset, it maintains a high level of ranking ability (AUC>0.90).

Problem

• Identifying encryption algorithms when plaintext distribution shifts
• Reducing classifier dependency on plaintext features
• Maintaining robust performance across different data domains

Innovation

• Uses statistical tests for ciphertext randomness features
• Constructs algorithm fingerprints from frequency distributions
• Avoids end-to-end learning from ciphertext bytes