Robust Cryptosystem Identification Under Various Operation Modes Using Deep Recurrent Neural Networks

In the Ciphertext Only Attack (COA), an attacker can access and use only ciphertexts, identifying the type of cryptosystem is critical for further attack. The attacker can analyze patterns in the ciphertexts that have different forms according to the cryptosystem and recognize the type of cryptosystem. We propose deep learning-based cryptosystem identification by investigating eight cryptosystems, DES, S-DES, AES, S-AES, Blowfish, RC2, SPECK, and RSA. The Recurrent Neural Network (RNN)-based deep learning model with Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) is utilized to identify cryptosystems. The proposed method is used to classify ciphertext in each operation mode such as CBC, CFB, OFB, and CTR, into the corresponding cipher system. The performance of the proposed method was evaluated with recall, precision, classification accuracy, and F1 score. To verify effectiveness and superiority, we compared the proposed method with different machine learning-based and deep learning-based classifiers such as Support Vector Machine (SVM), K-Nearest Neighbor (KNN), and BERT, a Large Language Model (LLM). Moreover, the previous methods in cryptosystem identification were also compared with the proposed method, and the results showed that eight cryptosystems were successfully recognized under various operation modes. The proposed method outperformed the other machine learning-based, and its deep learning-based classifiers were superior in cryptosystem identification. Furthermore, the proposed method showed a classification accuracy of 97.3 and 96.2 % in CBC and CFB, respectively, while the highest accuracy in the previous methods was 20% in CBC and 85.5% in CFB.