2025/11/11 by Xiwen Ren, Min Luo, Ren, Xiwen +5
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #cs.CR
paper · pdf · doi:10.48550/arxiv.2511.08296
Corresponding authors: Min Luo ([email protected]), Cong Peng ([email protected]). Added an acknowledgment of support from the National Cryptologic Science Fund of China (Grant No. 2025NCSF02019). No other changes were made
arxiv created 2026/07/30 · arxiv updated 2026/07/31
Modern encryption algorithms form the foundation of digital security. However, the widespread use of encryption algorithms results in significant challenges for network defenders in identifying which specific algorithms are being employed. More importantly, we find that when the plaintext distribution of test data departs from the training data, the performance of classifiers often declines significantly. This issue exposes the feature extractor's hidden dependency on plaintext features. To reduce this dependency, we adopt a method that does not learn end-to-end from ciphertext bytes. Specifically, this method is based on a set of statistical tests to compute the randomness feature of the ciphertext, and then uses the frequency distribution pattern of this feature to construct the algorithms' respective fingerprints. The experimental results demonstrate that our method achieves high discriminative performance (e.g., AUC > 0.98) in the Canterbury Corpus dataset, which contains a diverse set of data types. Furthermore, in our cross-domain evaluation, baseline models' performance degrades significantly when tested on data with a reduced proportion of structured plaintext. In sharp contrast, our method demonstrates high robustness: performance degradation is minimal when transferring between different structured domains, and even on the most challenging purely random dataset, it maintains a high level of ranking ability (AUC > 0.90).