A malicious certificate automatic detection system and method based on deep learning technology

Abstract

The present invention relates to a malicious certificate automatic detection system and method based on deep learning technology, which can automatically extract feature vectors of different fields of certificates, carry out weighted fusion, and finally obtain deeper certificate representation vectors for detection of malicious certificates. Specifically, it includes: based on the value characteristics of different fields of the certificate, the corresponding data preprocessing method is designed, and the certificate field is converted into a numerical representation that can be processed by the computer; based on the vectorization method and the depth model, different feature extraction methods are designed. It is used to extract the feature representation vectors of different fields of the certificate; based on the self-attention mechanism, a weighted fusion method of feature vectors is designed to fuse the feature vectors of different fields of the certificate to obtain the representation vector of the entire certificate; a malicious certificate based on deep learning is defined The detection framework, designed the framework to form the functions of each module and the detection process.

Description

technical field [0001] The invention relates to the fields of network security and deep learning, in particular to a system and method for automatic detection of malicious certificates based on deep learning technology. Background technique [0002] The traditional malicious certificate detection method is mainly based on the detection method of blacklist discovery. Through scanning, collecting and sorting in the Internet, a sample database of malicious certificates is constructed, and then the certificates to be detected are matched with the certificates in the blacklist database. At the same time, this detection model needs to frequently download the latest malicious certificate samples from threat intelligence data sources, update the blacklist database, and ensure the timeliness of detection results. Obviously, this blacklist-based detection method can indeed achieve a good detection effect on known attack types, but it is difficult to achieve effective results for unkno...

AI Technical Summary

Problems solved by technology

The above-mentioned malicious certificate detection method based on feature engineering requires a lot of human resources to design and select features, and there is still a lot of room for improvement in the detection effect

At the same time, this method relies heavily on artificially designed features. Malicious attackers can evade detection by intentionally modifying the value of the certificate field, and it is not very practical in real environments.

Images