VarunGowda/crypto-binary-detector

🔐 Crypto Binary Detector — XGBoost Model

Runtime detection of cryptographic algorithms in Linux ELF binaries using an XGBoost classifier trained on 80 static features extracted from compiled binaries.

Model Performance

Metric	Test Set	5-Fold CV (mean ± std)
Accuracy	95.74%	94.05% ± 3.52%
F1 Score	93.33%	90.71% ± 5.23%
ROC AUC	95.83%	98.17% ± 1.50%
MCC	90.21%	87.05% ± 7.19%

Overfitting gap: 2.1% (Train acc 97.8% vs Test acc 95.7%) ✅

Top 10 Discriminative Features

Selected via ensemble ranking (Mutual Information + XGBoost importance + Pearson Correlation):

Rank	Feature	What it Captures
1	crypto_string_ratio	Ratio of crypto-related strings (aes, sha, encrypt, etc.)
2	sec_entropy_max	Maximum section entropy — crypto code has distinctive high-entropy sections
3	crypto_constant_hits	YARA-like scan for AES S-box, SHA init vectors, DES tables
4	text_rotate_density	ROL/ROR instruction density — crypto uses heavy bitwise rotation
5	sec_rodata_entropy	.rodata section entropy — lookup tables (S-boxes) are high entropy
6	sec_text_entropy	.text section entropy — crypto round functions are near-uniform
7	text_xor_density	XOR instruction density — core crypto operation
8	sec_entropy_std	Entropy variation across sections — crypto binaries show wider range
9	n_crypto_strings	Count of crypto-related strings in binary
10	avg_string_len	Average string length — structural indicator

Anti-Overfitting Measures

• L1 regularization (reg_alpha=0.5)
• L2 regularization (reg_lambda=2.0)
• Shallow trees (max_depth=5, tuned via GridSearch)
• Row subsampling (subsample=0.8)
• Column subsampling (colsample_bytree=0.8, colsample_bylevel=0.8)
• Minimum child weight = 3
• Gamma / min split loss = 0.1
• Stratified 5-Fold CV
• Class imbalance handling (scale_pos_weight=2.25)
• Learning curve analysis

Dataset

• 232 Linux ELF binaries compiled from 29 unique C programs
• 9 crypto programs: Custom AES (S-box), SHA-256, SHA-1, MD5, RC4, DES, ChaCha20, Blowfish, XOR cipher
• 20 non-crypto programs: Sorting algorithms, data structures, string ops, file I/O, math, signal processing, etc.
• 8 compile variants per source: -O0, -O2, -Os, -O3, PIE, stripped, static
• 80 features extracted per binary using LIEF + custom analysis

Usage

import xgboost as xgb
import json

# Load model
model = xgb.XGBClassifier()
model.load_model("crypto_detector_xgboost.json")

# Load feature list
with open("top10_features.json") as f:
    features = json.load(f)["features"]

# Extract features from a binary (see scripts/feature_extraction.py)
# features_dict = extract_features("/path/to/binary")
# X = [features_dict[f] for f in features]
# prediction = model.predict([X])

Files

• crypto_detector_xgboost.json — Trained XGBoost model
• top10_features.json — Feature names and ranking details
• results_summary.json — Full evaluation metrics
• figures/ — Visualizations (SHAP, ROC, learning curves, etc.)
• scripts/ — Full pipeline: dataset creation, feature extraction, training

References

• EMBER feature engineering (Anderson & Roth, 2018) adapted for ELF
• LIEF library for binary parsing
• SHAP for model interpretability