Identifying Cryptographic Function via Dynamic Entropy Based on Static Heuristic Filtration
Jizhong Li, Liehui Jiang, Qing Yin, Hui Shu · International Conference on Multimedia Information Networking and Security · 2013
When analyzing modern malware and reversing encrypted protocol, the first absolutely necessary work is to identify and locate the main cryptographic functions. However, both present static and dynamic approaches have their disadvantages. In this paper, we have proposed a novel technique to identify cryptographic functions via dynamic entropy based on static heuristic filtration. Firstly, we filter the potential crypto functions by heuristic characters such as leaf function, BBL, arithmetic and bit wise operation, loop structure. Then we verify the potential crypto functions of static filtrations in dynamic trace and adopt average entropy value of input and output data to identify cryptographic functions. The experiment result has confirmed the efficiency and accuracy of this heuristic method.