SSL/TLS encrypted malicious service discovery method based on certificate characteristic generalization and server change behavior

Abstract

The invention relates to an SSL/TLS encrypted malicious service discovery method based on certificate characteristic generalization and server change behavior. The method includes 1) collecting certificates of known malicious services; 2) extracting the attributes of the collected certificates, classifying the certificates according to different service types, and extracting a generalization characteristic from attribute domains and attribute relations of various certificates; and 3) based on the extracted generalization characteristic, performing potential malicious service discovery based on the certificate generalization characteristic in a real network environment. If the Step 2) cannot extract the generalization characteristic, the certificate change law is discovered by tracking the certificates of the known malicious servers, thereby discovering malicious services. The SSL/TLS encrypted malicious service discovery method based on certificate characteristic generalization and server change behavior can aim at SSL/TLS encrypted remote control malicious services, reasonable screening is performed in a controllable range, and a set of malicious servers that are discovered is expanded, thereby providing a basis for further deep safety analysis and evidence obtaining.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to an SSL / TLS encryption malicious service discovery method based on certificate feature generalization and server change behavior. Background technique [0002] In recent years, in consideration of data security and privacy, Secure Sockets Layer / Transport Layer Security (SSL / TLS, namely Secure Sockets Layer Protocol and Transport Layer Security Protocol) encryption application services represented by HTTPS have increased significantly. Malicious services are also gradually migrating to SSL / TLS, using this public encryption scheme to hide themselves and avoid security detection. It has been found that a variety of malicious software uses SSL / TLS encrypted command and control channels, such as Dyre and Dridex Trojans (stealing bank accounts), Gozi (financial crimes, stealing accounts) and TorrentLocker and other ransomware, which are very harmful. [0003] T...

AI Technical Summary

Problems solved by technology

Such methods often rely on the training data set itself, which requires repeated training and adjustment of parameters to obtain higher performance, and the real-time performance is insufficient in practical applications.

At the same time, these methods are only aimed at services such as phishing, and do not conduct research on malicious services with remote control functions such as Trojan horses and botnets.

In addition, this type of method only starts from the certificate, without considering the specific behavior attributes of the service. When the malicious opponent deliberately changes the certificate attributes greatly, the performance of the method will drop sharply, and the robustness is insufficient.

[0008] The fingerprint generated based on certificate SHA1 and other hash algorithms and the detection method of the corresponding malicious server IP port belong to the traditional known blacklist filtering in principle, which is obviously lagging; at the same time, because the controller can quickly and frequently update the certificate and server IP at any time , and the attributes of the certificate itself have no fixed fingerprint features that can be extracted, which makes it difficult to detect similar malicious services in a large area by only relying on a small number of known SHA1 fingerprints and IP address blacklist detection methods, which is of little practical significance

Images