Detecting the File Encryption Algorithms Using Artificial Intelligence
Source abstract
Abstract
In this paper, the authors analyze the applicability of artificial intelligence algorithms for classifying file encryption methods based on statistical features extracted from the binary content of files. The prepared datasets included both unencrypted files and files encrypted using selected cryptographic algorithms in Electronic Codebook (ECB) and Cipher Block Chaining (CBC) modes. These datasets were further diversified by varying the number of encryption keys and the sample sizes. Feature extraction focused solely on basic statistical parameters, excluding an analysis of file headers, keys, or internal structures. The study evaluated the performance of several models, including Random Forest, Bagging, Support Vector Machine, Naive Bayes, K-Nearest Neighbors, and AdaBoost. Among these, Random Forest and Bagging achieved the highest accuracy and demonstrated the most stable results. The classification performance was notably better in ECB mode, where no random initialization vector was used. In contrast, the increased randomness of data in CBC mode resulted in lower classification effectiveness, particularly as the number of encryption keys increased. This paper provides a comprehensive analysis of the classifiers’ performance across various encryption configurations and suggests potential directions for further experiments.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Steganography and Watermarking Techniques · Digital and Cyber Forensics · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Faculty of Computer Science, Bialystok University of Technology, 45A Wiejska Str., PL-15351 Bialystok, Poland
Funding
Bialystok University of Technology · Ministry of Science and Higher Education in Poland
References (64)
Show source-provided references
1. Reliable detection of compressed and encrypted data10.1007/s00521-022-07586-7 ↗
2. CipherTrace: Automatic detection of ciphers from execution traces to neutralize ransomware10.1093/cybsec/tyae008 ↗
3. Machine learning for cryptographic algorithm identification10.17648/enig.v3i1.55 ↗
4. A block cipher algorithm identification scheme based on hybrid k-nearest neighbor and random forest algorithm10.7717/peerj-cs.1110 ↗
5. Manjula, R., and Anitha, R. (2011, January 2–4). Identification of Encryption Algorithm Using Decision Tree. Proceedings of the First International Conference on Computer Science and Information Technology, CCSIT 2011, Bangalore, India.10.1007/978-3-642-17881-8_23 ↗
6. Xia, R., Li, M., and Chen, S. (2022, January 23–24). Cryptographic algorithms identification based on deep learning. Proceedings of the 3rd International Conference on Artificial Intelligence and Machine Learning (CAIML 2022), Toronto, ON, Canada.
7. Chen, M., Zhu, Y., Mei, L., Zhang, X., Yuan, S., and Hu, B. (2024, January 30–31). The Cryptographic Algorithm Identification: Using Deep Learning to Empower Smart Grids. Proceedings of the International Conference on Machine Intelligence and Digital Applications MIDA ’24, Ningbo, China.10.1145/3662739.3663379 ↗
8. Hu, H., and Yuan, K. (2025, January 10–12). Identification of Cryptographic Algorithms Based on CNN. Proceedings of the 4th International Conference on Computer, Artificial Intelligence and Control Engineering CAICE ’25, Hefei, China.10.1145/3727648.3727680 ↗
9. Intelligent identification of cryptographic ciphers using machine learning techniques
10. Yan, X. (2023). Deep Learning-Based Efficient Analysis for Encrypted Traffic. Appl. Sci., 13.10.3390/app132111776 ↗
11. Ruhil, S., Bhadauria, S., and Kushwaha, J.P. (2024, January 24–28). Encrypted Network Traffic Classification using Deep Learning. Proceedings of the 15th International Conference on Computing Communication and Networking Technologies ICCCNT, Kamand, India.10.1109/ICCCNT61001.2024.10724208 ↗
12. Davies, S.R., Macfarlane, R., and Buchanan, W.J. (2022). Comparison of entropy calculation methods for ransomware encrypted file identification. Entropy, 24.10.3390/e24101503 ↗
13. Detection of encrypted executable files based on entropy analysis to determine the randomness measure of byte sequences10.3103/S0146411617080041 ↗
14. Lee, K., Lee, J., Lee, S.-Y., and Yim, K. (2023). Effective Ransomware Detection Using Entropy Estimation of Files for Cloud Services. Sensors, 23.10.3390/s23063023 ↗
15. Bailey, D.V. (2019). Systems and Methods for Detection and Mitigation of Malicious Encryption. (2019/0109869 A1), U.S. Patent, Available online: https://patents.google.com/patent/US20190109869A1/en.
16. Conte, T.M., and Wolfe, A. (2014). Techniques for Detecting Encrypted Data. (8,799,671 B2), U.S. Patent, Available online: https://patents.google.com/patent/US8799671B2/en.
17. Boutnaru, S. (2020). Techniques for Detecting Encryption. (2018/0075234 A1), U.S. Patent, Available online: https://patents.google.com/patent/US10671724B2/en.
18. Differential area analysis for ransomware attack detection within mixed file datasets10.1016/j.cose.2021.102377 ↗
19. Differential Area Analysis for Ransomware: Attacks, Countermeasures, and Limitations10.1109/TDSC.2025.3532324 ↗
20. Dileep, A.D., and Sekhar, C.C. (2006, January 16–21). Identification of Block Ciphers using Support Vector Machines. Proceedings of the 2006 International Joint Conference on Neural Networks (IJCNN), Vancouver, WC, Canada.10.1109/IJCNN.2006.247172 ↗
21. De Gaspari, F., Hitaj, D., Pagnotta, G., De Carli, L., and Mancini, L.V. (2020). EnCoD: Distinguishing compressed and encrypted file fragments. arXiv.10.1007/978-3-030-65745-1_3 ↗
22. CSC—IT Center for Science, Finland (2025, October 02). Research Data File Formats and Digital Preservation—Final Report. Available online: https://avointiede.fi/sites/default/files/2019-12/research%20data%20file%20formats%20Final%20report.pdf.
23. University of British Columbia Library (2025, October 02). File Formats|Research Data Management. Available online: https://ubc-library-rc.github.io/rdm/content/02_file_formats.html.
24. ScienceDirect (2025, October 02). Common File Format—An Overview. Available online: https://www.sciencedirect.com/topics/computer-science/common-file-format.
25. (2025, August 04). Faker Documentation. Welcome to Faker’s Documentation!. Available online: https://faker.readthedocs.io/en/master/.
26. (2025, August 04). Pillow Documentation. Available online: https://pillow.readthedocs.io/en/stable/.
27. (2025, August 04). Python Documentation. Wave. Available online: https://docs.python.org/3/library/wave.html.
28. (2025, August 04). NumPy Documentation. NumPy. Available online: https://numpy.org/doc/stable/.
29. (2025, August 04). PyCryptodome Documentation. Crypto.Cipher Package. Available online: https://pycryptodome.readthedocs.io/en/latest/src/cipher/cipher.html.
30. (2025, August 04). PyCryptodome Documentation. Crypto.Random Package. Available online: https://pycryptodome.readthedocs.io/en/latest/src/random/random.html.
31. (2025, August 04). PyCryptodome Documentation. Crypto.Util Package. Available online: https://pycryptodome.readthedocs.io/en/latest/src/util/util.html.
32. (2025, August 04). PyCryptodome Documentation. ARC4. Available online: https://pycryptodome.readthedocs.io/en/latest/src/cipher/arc4.html.
33. (2025, August 04). NumPy Documentation. numpy.mean. Available online: https://numpy.org/doc/stable/reference/generated/numpy.mean.html.
34. (2025, August 04). NumPy Documentation. numpy.var. Available online: https://numpy.org/doc/stable/reference/generated/numpy.var.html.
35. (2025, August 04). NumPy Documentation. numpy.sqrt. Available online: https://numpy.org/doc/stable/reference/generated/numpy.sqrt.html.
36. (2025, August 04). NumPy Documentation. numpy.histogram. Available online: https://numpy.org/doc/stable/reference/generated/numpy.histogram.html.
37. (2025, August 04). NumPy Documentation. numpy.std. Available online: https://numpy.org/doc/stable/reference/generated/numpy.std.html.
38. (2025, August 04). NumPy Documentation. numpy.sum. Available online: https://numpy.org/doc/stable/reference/generated/numpy.sum.html.
39. (2025, August 04). SciPy Documentation. scipy.stats.skew. Available online: https://docs.scipy.org/doc/scipy/reference/generated/scipy.stats.skew.html.
40. (2025, August 04). SciPy Documentation. scipy.stats.kurtosis. Available online: https://docs.scipy.org/doc/scipy/reference/generated/scipy.stats.kurtosis.html.
41. (2025, August 04). Python Documentation. collections. Available online: https://docs.python.org/3/library/collections.html.
42. (2025, August 04). Python Documentation. math. Available online: https://docs.python.org/3/library/math.html.
43. (2025, August 04). Pandas Documentation. Pandas Version 2.3.1. Available online: https://pandas.pydata.org/docs/.
44. (2025, August 04). Scikit-Learn Documentation. Preprocessing Data. Available online: https://scikit-learn.org/stable/modules/preprocessing.html.
45. (2025, August 04). Scikit-Learn Documentation. sklearn.model_selection. Available online: https://scikit-learn.org/stable/api/sklearn.model_selection.html.
46. (2025, August 04). Scikit-Learn Documentation. sklearn.metrics. Available online: https://scikit-learn.org/stable/api/sklearn.metrics.html.
47. (2025, August 04). Scikit-Learn Documentation. sklearn.ensemble. Available online: https://scikit-learn.org/stable/api/sklearn.ensemble.html.
48. (2025, August 04). Scikit-Learn Documentation. sklearn.svm. Available online: https://scikit-learn.org/stable/api/sklearn.svm.html.
49. (2025, August 04). Scikit-Learn Documentation. sklearn.naive_bayes. Available online: https://scikit-learn.org/stable/api/sklearn.naive_bayes.html.
50. (2025, August 04). Scikit-Learn Documentation. sklearn.neighbors. Available online: https://scikit-learn.org/stable/api/sklearn.neighbors.html.
51. (2025, August 04). Matplotlib Documentation. Matplotlib. Available online: https://matplotlib.org/stable/index.html.
52. (2025, August 04). Seaborn Documentation. Seaborn. Available online: https://seaborn.pydata.org.
53. A Mathematical Theory of Communication10.1002/j.1538-7305.1948.tb01338.x ↗
54. Efektywność parametrów statystycznych w detekcji informacji szyfrowanej
55. (2025, August 04). Scikit-Learn Documentation. sklearn.ensemble.RandomForestClassifier. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.RandomForestClassifier.html.
56. (2025, August 04). Scikit-Learn Documentation. sklearn.svm.SVC. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.svm.SVC.html.
57. (2025, August 04). Scikit-Learn Documentation. sklearn.neighbors.KNeighborsClassifier. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.neighbors.KNeighborsClassifier.html.
58. (2025, August 04). Scikit-Learn Documentation. sklearn.naive_bayes.GaussianNB. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.naive_bayes.GaussianNB.html.
59. (2025, August 04). Scikit-Learn Documentation. sklearn.ensemble.AdaBoostClassifier. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.AdaBoostClassifier.html.
60. (2025, August 04). Scikit-Learn Documentation. sklearn.ensemble.BaggingClassifier. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.BaggingClassifier.html.
61. (2025, August 04). Scikit-Learn Documentation. sklearn.preprocessing.MinMaxScaler. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.preprocessing.MinMaxScaler.html.
62. (2025, August 04). Scikit-Learn Documentation. sklearn.preprocessing.StandardScaler. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.preprocessing.StandardScaler.html.
63. Sharif, S.O., and Mansoor, S.P. (2011, January 1–2). Performance Evaluation of Classifiers used for Identification of Encryption Algorithms. Proceedings of the Second International Conference on Advances in Information and Communication Technologies ICT 2011, Hamburg, Germany.
64. Chidambaranathan, S., Santhanaraj, M., Ajitha, E., Syed Fiaz, A.S., Suchithra, B., and Kathirvel, T. (2024, January 17–18). Automated Detection of Encryption Algorithms Using AI Techniques. Proceedings of the International Conference on IoT Based Control Networks and Intelligent Systems ICICNI), Bengaluru, India.10.1109/ICICNIS64247.2024.10823274 ↗