| # 🔐 Crypto Binary Detector — XGBoost Model |
|
|
| **Runtime detection of cryptographic algorithms in Linux ELF binaries** using an XGBoost classifier trained on 80 static features extracted from compiled binaries. |
|
|
| ## Model Performance |
|
|
| | Metric | Test Set | 5-Fold CV (mean ± std) | |
| |--------|----------|------------------------| |
| | **Accuracy** | 95.74% | 94.05% ± 3.52% | |
| | **F1 Score** | 93.33% | 90.71% ± 5.23% | |
| | **ROC AUC** | 95.83% | 98.17% ± 1.50% | |
| | **MCC** | 90.21% | 87.05% ± 7.19% | |
|
|
| **Overfitting gap: 2.1%** (Train acc 97.8% vs Test acc 95.7%) ✅ |
|
|
| ## Top 10 Discriminative Features |
|
|
| Selected via ensemble ranking (Mutual Information + XGBoost importance + Pearson Correlation): |
|
|
| | Rank | Feature | What it Captures | |
| |------|---------|------------------| |
| | 1 | `crypto_string_ratio` | Ratio of crypto-related strings (aes, sha, encrypt, etc.) | |
| | 2 | `sec_entropy_max` | Maximum section entropy — crypto code has distinctive high-entropy sections | |
| | 3 | `crypto_constant_hits` | YARA-like scan for AES S-box, SHA init vectors, DES tables | |
| | 4 | `text_rotate_density` | ROL/ROR instruction density — crypto uses heavy bitwise rotation | |
| | 5 | `sec_rodata_entropy` | .rodata section entropy — lookup tables (S-boxes) are high entropy | |
| | 6 | `sec_text_entropy` | .text section entropy — crypto round functions are near-uniform | |
| | 7 | `text_xor_density` | XOR instruction density — core crypto operation | |
| | 8 | `sec_entropy_std` | Entropy variation across sections — crypto binaries show wider range | |
| | 9 | `n_crypto_strings` | Count of crypto-related strings in binary | |
| | 10 | `avg_string_len` | Average string length — structural indicator | |
|
|
| ## Anti-Overfitting Measures |
|
|
| - L1 regularization (reg_alpha=0.5) |
| - L2 regularization (reg_lambda=2.0) |
| - Shallow trees (max_depth=5, tuned via GridSearch) |
| - Row subsampling (subsample=0.8) |
| - Column subsampling (colsample_bytree=0.8, colsample_bylevel=0.8) |
| - Minimum child weight = 3 |
| - Gamma / min split loss = 0.1 |
| - Stratified 5-Fold CV |
| - Class imbalance handling (scale_pos_weight=2.25) |
| - Learning curve analysis |
| |
| ## Dataset |
| |
| - **232 Linux ELF binaries** compiled from 29 unique C programs |
| - **9 crypto programs**: Custom AES (S-box), SHA-256, SHA-1, MD5, RC4, DES, ChaCha20, Blowfish, XOR cipher |
| - **20 non-crypto programs**: Sorting algorithms, data structures, string ops, file I/O, math, signal processing, etc. |
| - **8 compile variants** per source: -O0, -O2, -Os, -O3, PIE, stripped, static |
| - **80 features** extracted per binary using LIEF + custom analysis |
| |
| ## Usage |
| |
| ```python |
| import xgboost as xgb |
| import json |
| |
| # Load model |
| model = xgb.XGBClassifier() |
| model.load_model("crypto_detector_xgboost.json") |
|
|
| # Load feature list |
| with open("top10_features.json") as f: |
| features = json.load(f)["features"] |
| |
| # Extract features from a binary (see scripts/feature_extraction.py) |
| # features_dict = extract_features("/path/to/binary") |
| # X = [features_dict[f] for f in features] |
| # prediction = model.predict([X]) |
| ``` |
| |
| ## Files |
| |
| - `crypto_detector_xgboost.json` — Trained XGBoost model |
| - `top10_features.json` — Feature names and ranking details |
| - `results_summary.json` — Full evaluation metrics |
| - `figures/` — Visualizations (SHAP, ROC, learning curves, etc.) |
| - `scripts/` — Full pipeline: dataset creation, feature extraction, training |
|
|
| ## References |
|
|
| - EMBER feature engineering (Anderson & Roth, 2018) adapted for ELF |
| - LIEF library for binary parsing |
| - SHAP for model interpretability |
|
|
