Malicious certificate automatic detection system and method based on deep learning technology

Abstract

The invention relates to a malicious certificate automatic detection system and method based on a deep learning technology, which can automatically extract feature vectors of different fields of a certificate, carry out weighted fusion, and finally obtain a deeper certificate representation vector for malicious certificate detection. The method specifically comprises the steps of designing a corresponding data preprocessing method based on value characteristics of different fields of a certificate, and converting the certificate fields into numerical representation which can be processed by acomputer; based on a vectorization method and a depth model, designing different feature extraction methods for extracting feature representation vectors of different fields of the certificate; basedon a self-attention mechanism, designing a weighted fusion method of feature vectors, and fusing the feature vectors of different fields of the certificate to obtain a representation vector of the whole certificate; defining a malicious certificate detection framework based on deep learning, and designing the framework to form all module functions and detection processes.

Description

technical field [0001] The invention relates to the fields of network security and deep learning, in particular to a system and method for automatic detection of malicious certificates based on deep learning technology. Background technique [0002] The traditional malicious certificate detection method is mainly based on the detection method of blacklist discovery. Through scanning, collecting and sorting in the Internet, a sample database of malicious certificates is constructed, and then the certificates to be detected are matched with the certificates in the blacklist database. At the same time, this detection model needs to frequently download the latest malicious certificate samples from threat intelligence data sources, update the blacklist database, and ensure the timeliness of detection results. Obviously, this blacklist-based detection method can indeed achieve a good detection effect on known attack types, but it is difficult to achieve effective results for unkno...

AI Technical Summary

Problems solved by technology

The above-mentioned malicious certificate detection method based on feature engineering requires a lot of human resources to design and select features, and there is still a lot of room for improvement in the detection effect

At the same time, this method relies heavily on artificially designed features. Malicious attackers can evade detection by intentionally modifying the value of the certificate field, and it is not very practical in real environments.

Images