An automated construction method for symmetric encryption round function models based on dynamic analysis

With the deepening of informatization, the incidence of cybercrimes utilizing malicious software for attacks is on the rise. This paper addresses the detection issue of symmetric encryption in malicious software from the perspective of cryptography, proposing an automated method for constructing a symmetric encryption round function model based on dynamic analysis. This method tracks data flow at the granularity of registers to characterize Directed Acyclic Graph (DAG) construction of round function models. Initially, dynamic execution traces of binary files are captured using Intel Pin, identifying loops within them. Data flow tracking at the register level within loops is performed, creating DAG, and analyzing whether the loops exhibit characteristics of symmetric cipher round functions, thus constructing the round function model. This approach enables the detection of symmetric encryption within binary files and the construction of round function models, offering a novel solution for fine-grained symmetric cipher recognition and laying a foundation for detecting malicious software containing symmetric encryption.