On Neurocryptanalysis of DES and 3DES

In the past few years, and more often recently, I have received several emails asking questions about two papers that I have published back in 2012. The papers are:

Mohammed M. Alani, Neuro-Cryptanalysis of DES and Triple-DES, published in proceedings of the 19th International Conference on Neural Information Processing (ICONIP2012), Nov. 2012, Doha, Qatar.(LNCS 7667/2012, Springer,

Mohammed M. Alani, Neuro-Cryptanalysis of DES, Proceedings of the World Congress on Internet Security 2012, June 10th-12th, 2012, University of Guelph, Ontario, Canada.(IEEE Xplore)

Hence, I would like to clarify a few things.

The work published in these two papers was done back in 2008-2010 based on the initial idea that I presented in my masters thesis in 2003. The first set of results I received at that time were unbelievable in comparison to other cryptanalysis techniques in terms of number of known-plaintext-ciphertext pairs, time, and processing needed. However, soon I came to know that they were not realistic.

I prepared the first version of the paper back in 2009 and sent it to the International Journal of Information Security. At that time, the EiC was Prof.Dieter Gollmann. I received a rejection letter from Prof.Gollmann only a few days later. I responded to the letter with some explanation of the points that I have apparently misrepresented in the paper. From there, we kept corresponding for about 6 months. I found that Prof.Gollmann’s support and comments were extremely useful and have shifted my thinking on how the experiment was supposed to be done. For that, I will remain thankful to him. Later on, I decided to send it to a conference instead. Seeking faster approval before someone else presents the same idea.

What is motivating me to write this post, is the fact that I have received several emails from different researchers around the world saying that they were not able to reproduce the same results. This actually got me to investigate the mater and see why these results could not be reproduced.

The first issue I faced was the loss of the original experiments data that were previously used. Since 2009, I have moved to live in 4 different countries, and apparently I have lost much of my old research data in the process of moving. Hence, I could not reproduce the same results because I did not have access to the same data. It needs to be clear to fellow researchers that it is absolutely normal to have varying degrees of success in the proposed method, as described in the second paper. Those of you who are experienced in training neural networks are aware that the success and failure can be heavily dependent on the initial weights among other variables, and not solely dependent on your data.

I have been asked several times to share the MATLAB code as well. There was no ‘code’ as in a complete program. Back then, I used the neural networks toolbox of MATLAB2008. I used direct commands like:

net = newff(input, output, … , {'logsig' 'logsig'}, 'trainscg');

I used plaintext that was generated by a pseudo-random number generator. Then I encrypted the text using my own implementation of DES. Then, I wrote a small program to transform ciphertext into a matrix of zeros and ones so that I use this matrix for NN training in MATLAB. This transformation is done through removing the parity bit of each byte and then producing the ASCII code in bits.

I had success in about 10% of the experiments that I have done back then. I remember doing hundreds and hundreds of experiments. It is obvious that the presented results were selected from hundreds of failures. As I mentioned earlier, the starting conditions of training were a lot and in my experiments I left most of them to be handled by MATLAB. This might have reduced the time I needed to succeed in some of these experiences, but it definitely did not make the reproduction of these results any easier.

This post is not written in the intent of defending the papers, nor in arguing their accuracy. The intention behind this post is to clarify some issues and reasons why you might not be able to reproduce the exact same results.

The bottom line is that I can understand that some researchers are facing difficulties in reproducing the results due to my reliance on MATLAB in using default values, or MATLAB initialization of other important values. However, this does not nullify the importance and potential of the method presented in these two papers.

Paper: Android Users Privacy Awareness Survey


Having a share of over 80% of the smartphone market, Android has become an important mobile operating system that is used by billions of users on daily basis. With the widespread use of smartphones in general, and Android in specific, privacy concerns grow with that expansion in the user base. With the millions of applications being downloaded by users daily, it is becoming increasingly difficult to differentiate between the good and the bad in terms of security and privacy. In this paper, we present the results of a survey conducted among 4027 Android users worldwide. This survey was conducted to measure the awareness of Android users regarding their privacy. The study measures the users’ interaction with the permissions required by different applications they install. The results of the survey show apparent weakness in the awareness of Android users regarding the privacy of their data.

Citation Info:

Mohammed M. Alani, “Android Users Privacy Awareness Survey”, International Journal of Interactive Mobile Technology (i-JIM), Vol 11, No 3, pp 130-144.

Full-text (open-access) can be accessed through the link:

Book: Elements of Cloud Computing Security

This work serves as a thorough, yet simple-to-read, reference on various aspects of cloud computing security. The text opens with an introduction to the general concepts of cloud computing necessary to build a basic understanding of the cloud, followed by a discussion of aspects of security. The work then examines how cloud security differs from conventional information security, and reviews cloud-specific classes of threats and attacks. A range of varying threats in cloud computing are covered, from threats of data loss and data breaches, to threats to availability and threats posed by malicious insiders. The text discusses cloud security attacks on different levels, including attacks on the hypervisor, and on the confidentiality of data. Newer attacks, such as side-channel attacks and resource-freeing attacks, are also described. The work concludes with a set of general security recommendations for the cloud.


eBook ISBN 978-3-319-41411-9

Softcover ISBN 978-3-319-41410-2

Link: Elements of Cloud Computing Security: A Survey of Key Practicalities

Paper: MANET Security: A Survey


Mobile Ad hoc Networks are being adopted in more and more applications in our daily life. Mobile computing and mobile ad hoc networks in particular have become a daily need. As mobile ad hoc networks have been target for many attacks, the security of these networks has become an essential part of their existence. This paper provides a review of the current threats and how these threats are mitigated. The paper also discusses common attacks on mobile ad hoc networks and classifies these attacks in various classification types. The paper also discusses various countermeasures to mitigate the risks of attacks.


Citation Info:

Mohammed M. Alani, MANET Security: A Survey, published in the 4th IEEE International Conference on Control System, Computing, and Engineering, Penang, Malaysia, November 2014.

Full text available on IEEE Xplore on this link:

Paper: Securing the Cloud against Distributed Denial of Service Attacks: A Review


Distributed denial of service attacks are becoming a serious threat that no business involved in providing services over the Internet can ignore. The rapidly growing frequency and magnitude in which these attacks are occurring is an alarming indicator. As cloud services are being adopted by many enterprises, the cloud infrastructure resilience to such attacks becomes a growing concern. In this paper, we discuss the types and possible impacts of DDoS attacks on cloud computing and the suggested mitigation techniques. These attacks were categorized into three categories; external, internal, and cloud-to-outside attacks.


Published in the Proceedings of the 2nd International Conference on Applied Information and Communication Technology, Muscat, Oman. 28-29 April, 2014.

Book: Guide to OSI and TCP/IP Models

  • Provides a simplified introduction to computer networks
  • Requires no prior background in the field
  • Discusses the fundamentals of the network, transport and application layers
This work opens with an accessible introduction to computer networks, providing general definitions of commonly used terms in networking. This is followed by a detailed description of the OSI model, including the concepts of connection-oriented and connectionless communications. The text carefully elaborates the specific functions of each layer, along with what is expected of protocols operating at each layer. Next, the journey of a single packet, from source to destination, is described in detail. The final chapter is devoted to the TCP/IP model, beginning with a discussion of IP protocols and the supporting ARP, RARP, and InARP protocols. The work also discusses the TCP and UDP protocols operating at the transport layer, and the application layer protocols HTTP, DNS, FTP, TFTP, SMTP, POP3, and Telnet. Important facts and definitions are highlighted in gray boxes found throughout the text.
Published: March, 2014 by Springer.

Guide to OSI and TCP/IP Model

Guide to OSI and TCP/IP Model

Paper: Mathematical Approximation of Delay in Voice over IP


This paper introduces a novel method of approximate calculation of delay in voice over IP systems. The proposed method relies on mathematical operations like interpolation and integration to produce a continuous function. This continuous function shows the delay in different times. The paper shows a detailed example of applying this method successfully to a sample call. The resulting delay function can help in better understanding of the variations of delay in different times and how it is affected by network load.


Citation Information:

Mohammed M. Alani, Mathematical Approximation of Delay in Voice over IP, International Journal of Computer and Information Technology (IJCIT), ISSN: 2279-0764, Vol. 3, Issue 1, pp. 78-82, January 2014.