File size: 3,481 Bytes
920efac | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 | # 🔐 Crypto Binary Detector — XGBoost Model
**Runtime detection of cryptographic algorithms in Linux ELF binaries** using an XGBoost classifier trained on 80 static features extracted from compiled binaries.
## Model Performance
| Metric | Test Set | 5-Fold CV (mean ± std) |
|--------|----------|------------------------|
| **Accuracy** | 95.74% | 94.05% ± 3.52% |
| **F1 Score** | 93.33% | 90.71% ± 5.23% |
| **ROC AUC** | 95.83% | 98.17% ± 1.50% |
| **MCC** | 90.21% | 87.05% ± 7.19% |
**Overfitting gap: 2.1%** (Train acc 97.8% vs Test acc 95.7%) ✅
## Top 10 Discriminative Features
Selected via ensemble ranking (Mutual Information + XGBoost importance + Pearson Correlation):
| Rank | Feature | What it Captures |
|------|---------|------------------|
| 1 | `crypto_string_ratio` | Ratio of crypto-related strings (aes, sha, encrypt, etc.) |
| 2 | `sec_entropy_max` | Maximum section entropy — crypto code has distinctive high-entropy sections |
| 3 | `crypto_constant_hits` | YARA-like scan for AES S-box, SHA init vectors, DES tables |
| 4 | `text_rotate_density` | ROL/ROR instruction density — crypto uses heavy bitwise rotation |
| 5 | `sec_rodata_entropy` | .rodata section entropy — lookup tables (S-boxes) are high entropy |
| 6 | `sec_text_entropy` | .text section entropy — crypto round functions are near-uniform |
| 7 | `text_xor_density` | XOR instruction density — core crypto operation |
| 8 | `sec_entropy_std` | Entropy variation across sections — crypto binaries show wider range |
| 9 | `n_crypto_strings` | Count of crypto-related strings in binary |
| 10 | `avg_string_len` | Average string length — structural indicator |
## Anti-Overfitting Measures
- L1 regularization (reg_alpha=0.5)
- L2 regularization (reg_lambda=2.0)
- Shallow trees (max_depth=5, tuned via GridSearch)
- Row subsampling (subsample=0.8)
- Column subsampling (colsample_bytree=0.8, colsample_bylevel=0.8)
- Minimum child weight = 3
- Gamma / min split loss = 0.1
- Stratified 5-Fold CV
- Class imbalance handling (scale_pos_weight=2.25)
- Learning curve analysis
## Dataset
- **232 Linux ELF binaries** compiled from 29 unique C programs
- **9 crypto programs**: Custom AES (S-box), SHA-256, SHA-1, MD5, RC4, DES, ChaCha20, Blowfish, XOR cipher
- **20 non-crypto programs**: Sorting algorithms, data structures, string ops, file I/O, math, signal processing, etc.
- **8 compile variants** per source: -O0, -O2, -Os, -O3, PIE, stripped, static
- **80 features** extracted per binary using LIEF + custom analysis
## Usage
```python
import xgboost as xgb
import json
# Load model
model = xgb.XGBClassifier()
model.load_model("crypto_detector_xgboost.json")
# Load feature list
with open("top10_features.json") as f:
features = json.load(f)["features"]
# Extract features from a binary (see scripts/feature_extraction.py)
# features_dict = extract_features("/path/to/binary")
# X = [features_dict[f] for f in features]
# prediction = model.predict([X])
```
## Files
- `crypto_detector_xgboost.json` — Trained XGBoost model
- `top10_features.json` — Feature names and ranking details
- `results_summary.json` — Full evaluation metrics
- `figures/` — Visualizations (SHAP, ROC, learning curves, etc.)
- `scripts/` — Full pipeline: dataset creation, feature extraction, training
## References
- EMBER feature engineering (Anderson & Roth, 2018) adapted for ELF
- LIEF library for binary parsing
- SHAP for model interpretability
|