Convolution Neural Network-Based Sensitive Security Parameter Identification and Analysis

Table 2

Estimated entropy values for noise sources by byte index through SP800-90B. Target noise sources are mainly used as entropy sources for software cryptographic modules in Windows 10. The smaller the entropy per byte (sum total/number of bytes), the more patterns appear in the image, and vice versa; it becomes increasingly difficult to recognize the pattern. The noise sources CryptGenRandom and CoCreateGuid, commonly used in Windows’s software cryptographic modules, have quite high entropy values and do not differ much. Therefore, even in their images, it seems indistinguishable by the eyes.

Target noise		GetTickCount	GetProcessHeap	CoCreateGuid	CryptGenRandom	GetProcessTimes
Byte index	0	0.303	0.000	7.863	7.883	7.882
	1	0.027	0.000	7.885	7.881	7.008
	2	0.002	7.876	7.884	7.877	0.587
	3	0.000	7.852	7.882	7.882	0.001
	4		7.882	7.878	7.888
	5		0.996	7.880	7.871
	6		0.000	7.886	7.865
	7		0.000	3.975	7.880
	8			5.939	7.879
	9			7.881	7.861
	10			7.869	7.879
	11			7.883	7.874
	12			7.862	7.864
	13			7.880	7.889
	14			7.883	7.879
	15			7.881	7.865
Sum total of		0.332	24.606	120.211	126.017	15.478
Average of min-entropy		0.083	3.076	7.513	7.876	3.870