# Detecting Encryption **URL:** \ **Category:** Zeek\ **Created:** [August 21, 2015, 5:36pm UTC](https://community.zeek.org/t/detecting-encryption/3780 "2015-08-21T17:36:30Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Ben\_Mixon-Baca](https://avatars.discourse-cdn.com/v4/letter/b/f9ae1b/32.png) [@Ben\_Mixon-Baca](https://community.zeek.org/u/Ben_Mixon-Baca)\ **Post date:** [August 21, 2015, 5:36pm UTC](https://community.zeek.org/t/detecting-encryption/3780/1 "2015-08-21T17:36:30Z")
Hi all, I am relatively new to Bro and was wondering if Bro has any way of detecting encryption and/or plain text in the dpd module or anywhere els e. I have several use cases. 1. I wish to determine whether a program that has an auto-update feature is sending the updates using encryption. 2. I wish to determine if a chat application is sending data encrypted. I had a suggestion from my advisor that I should compress the data being sent over the wire to see if it is compressible or not and use that in determining whether a stream is using encryption or not. Any suggestions or advice on this problem would be greatly appreciated. Regards, Ben Mixon-Baca ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [August 21, 2015, 5:48pm UTC](https://community.zeek.org/t/detecting-encryption/3780/2 "2015-08-21T17:48:04Z")
Check out ssl.log and x509.log. James ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [August 21, 2015, 7:50pm UTC](https://community.zeek.org/t/detecting-encryption/3780/3 "2015-08-21T19:50:15Z")
Bro has functions to measure entropy, see [https://www.bro.org/sphinx-git/scripts/base/bif/bro.bif.bro.html#id-find\_entropy](https://www.bro.org/sphinx-git/scripts/base/bif/bro.bif.bro.html#id-find_entropy). Robin ---
**Author:** ![Ben\_Mixon-Baca](https://avatars.discourse-cdn.com/v4/letter/b/f9ae1b/32.png) [@Ben\_Mixon-Baca](https://community.zeek.org/u/Ben_Mixon-Baca)\ **Post date:** [August 21, 2015, 7:52pm UTC](https://community.zeek.org/t/detecting-encryption/3780/4 "2015-08-21T19:52:11Z")
That is amazing! Would I need to make additions in a script of mine in order to differentiate between encryption and compression? > > I had a suggestion from my advisor that I should compress the > > data being sent over the wire to see if it is compressible or not > > and use that in determining whether a stream is using encryption > > or not. > > Bro has functions to measure entropy, see > [https://www.bro.org/sphinx-git/scripts/base/bif/bro.bif.bro.html#id-fi](https://www.bro.org/sphinx-git/scripts/base/bif/bro.bif.bro.html#id-fi) nd\_entropy. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 24, 2015, 1:59pm UTC](https://community.zeek.org/t/detecting-encryption/3780/5 "2015-08-24T13:59:25Z")
Unfortunately we still haven’t added file and connection entropy analyzers yet. I have a file entropy analyzer floating around somewhere, but generally both of those are extremely easy to write. I think that Ben would need those to do what he’s trying to do.   .Seth ---
**Author:** ![Ben\_Mixon-Baca](https://avatars.discourse-cdn.com/v4/letter/b/f9ae1b/32.png) [@Ben\_Mixon-Baca](https://community.zeek.org/u/Ben_Mixon-Baca)\ **Post date:** [August 24, 2015, 2:27pm UTC](https://community.zeek.org/t/detecting-encryption/3780/6 "2015-08-24T14:27:56Z")
Seth, was the link provided not a file entropy analyzer? > > Bro has functions to measure entropy, see > > [https://www.bro.org/sphinx-git/scripts/base/bif/bro.bif.bro.html#id-f](https://www.bro.org/sphinx-git/scripts/base/bif/bro.bif.bro.html#id-f) ind\_entropy. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 24, 2015, 2:50pm UTC](https://community.zeek.org/t/detecting-encryption/3780/7 "2015-08-24T14:50:12Z")
No, those are built-in-functions (BiFs) to calculate entropy on strings that are available in Bro’s scripting language.   .Seth ---
**Author:** ![Ben\_Mixon-Baca](https://avatars.discourse-cdn.com/v4/letter/b/f9ae1b/32.png) [@Ben\_Mixon-Baca](https://community.zeek.org/u/Ben_Mixon-Baca)\ **Post date:** [August 24, 2015, 2:51pm UTC](https://community.zeek.org/t/detecting-encryption/3780/8 "2015-08-24T14:51:15Z")
OK thanks. So I would write my own broscripts to do connection and file entropy analysis then right? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 24, 2015, 2:56pm UTC](https://community.zeek.org/t/detecting-encryption/3780/9 "2015-08-24T14:56:19Z")
These wouldn’t be written as scripts. Connection and file analyzers needs to be written as plugins or in the core. They are typically implemented in C++ or BinPAC.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/detecting-encryption/3780/10 "2022-05-06T15:42:59Z")