Certificate detection method and device, computer device and computer readable storage medium

Abstract

Embodiments of the present application provide a certificate detection method and device, computer equipment and computer readable storage medium, belonging to the field of network security, the identified one or more encryption protocols are parsed, a plurality of digital certificates and the metadata of each digital certificate are extracted, and each metadata is normalized to a sample data, a sample set is obtained, and the sample set is analyzed by clustering to divide all sample data into a plurality of clusters, and then all sample data in the cluster is divided into the same certificate and the same certificate, whether the same certificate and the same certificate are malicious certificates is judged, that is, all digital certificates are maliciously determined from the perspective of the same certificate and the same certificate, the vertical detection of digital certificates is realized in the form of the correlation analysis of a plurality of digital certificates, unknown attack behavior can be identified, and the detection effect and detection range are greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to a certificate detection method and device, computer equipment and computer readable storage medium. BACKGROUND

[0002] With the continuous development and wide application of network technology, the global network is moving towards a fully encrypted era. Encryption is a double-edged sword, which brings security to the network while also providing opportunities for malicious software. Malicious traffic is hidden in normal traffic, and security detection faces great challenges.

[0003] Currently, the detection methods for malicious encrypted traffic include: (1) detection based on a single certificate or certificate chain; (2) certificate detection based on traditional machine learning classification algorithms. Detection based on a single certificate or certificate chain is longitudinal detection, which can only reflect the certificate characteristics of the current session and cannot associate with other sessions. As APT organizations become more sophisticated, detection is difficult to be effective. Certificate detection based on traditional machine learning classification algorithms can only identify known threat behaviors within the sample space trained by known samples and their derivatives, and cannot identify unknown threat behaviors, so the detection results are limited. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a certificate detection method, device, computer equipment and computer readable storage medium, which can improve the problems of detection difficulty and limited detection results of the current malicious encrypted traffic detection method.

[0005] To achieve the above purpose, the technical solutions adopted by the embodiments of the present application are as follows:

[0006] In a first aspect, the present application provides a certificate detection method, which comprises:

[0007] analyzing the encrypted protocol, extracting a plurality of digital certificates under the encrypted protocol, and extracting the metadata of each digital certificate; wherein the encrypted protocol is an encrypted protocol identified from the to-be-detected traffic;

[0008] normalizing the metadata of each digital certificate, and taking the normalized metadata as a sample data to obtain a sample set;

[0009] performing cluster analysis on the sample set, dividing all sample data into a plurality of cluster classes, and dividing the sample data in each cluster class into the same certificate and the same certificate;

[0010] For each same certificate, it is judged whether the same certificate is a shared certificate, and if not, the same certificate is determined to be a malicious certificate;

[0011] For each of the same type of certificate, determine whether the same type of certificate is a legal authorized certificate group, if not, determine that the same type of certificate is a malicious certificate.

[0012] Further, the method for clustering analysis of the sample set and dividing all the sample data into multiple cluster classes comprises:

[0013] The k-means clustering algorithm is used to perform clustering analysis on the sample set to divide all the sample data into multiple cluster classes.

[0014] Further, the step of using the k-means clustering algorithm to perform clustering analysis on the sample set to divide all the sample data into multiple cluster classes comprises:

[0015] A predetermined number of sample data are selected from the sample set as center points; each center point corresponds to a cluster class;

[0016] For each of the sample data, the nearest center point with the smallest distance from the sample data is determined from all the center points, and the sample data is divided into the cluster class corresponding to the nearest center point;

[0017] After all the sample data are divided, the center point of each cluster class is calculated, and it is determined whether a predetermined clustering end condition is reached;

[0018] If yes, the multiple cluster classes currently divided are taken as the division result;

[0019] If no, return to the step of determining the nearest center point with the smallest distance from the sample data from all the center points for each of the sample data.

[0020] Further, the step of calculating the center point of each cluster class comprises:

[0021] The center point of each cluster class is calculated using a center point calculation formula;

[0022] The center point calculation formula comprises: wherein, represents the jth cluster class, represents the sample data in the jth cluster class, represents the center point of the jth cluster class.

[0023] Further, the step of dividing the sample data in each cluster class into the same certificate and the same type of certificate comprises:

[0024] For each of the cluster classes, the distance between each of the sample data in the cluster class and the center point of the cluster class is calculated;

[0025] all sample data with the distance less than or equal to the first threshold value as the same certificate, and all sample data with the distance greater than the first threshold value as the same type certificate.

[0026] Further, the step of judging whether the same certificate is a shared certificate comprises:

[0027] judging whether the same certificate is a multi-domain name certificate or a wildcard certificate, and if yes, determining that the same certificate is a shared certificate, and if not, determining that the same certificate is a malicious certificate.

[0028] Further, the step of judging whether the same type certificate is a legitimate authorized certificate group comprises:

[0029] randomly extracting metadata of a digital certificate from the same type certificate, judging whether the metadata matches certificate information in a legitimate certificate library, if yes, determining that the same type certificate is a legitimate authorized certificate group, and if not, determining that the same type certificate is a malicious certificate.

[0030] In a second aspect, an embodiment of the present application provides a certificate detection device, comprising an analysis module, a normalization module, a clustering module and a detection module.

[0031] The analysis module is configured to analyze an encryption protocol, extract a plurality of digital certificates under the encryption protocol, and extract metadata of each digital certificate, wherein the encryption protocol is an encryption protocol identified from to-be-detected traffic.

[0032] The normalization module is configured to normalize the metadata of each digital certificate, and take the normalized metadata as a sample data to obtain a sample set.

[0033] The clustering module is configured to perform clustering analysis on the sample set, divide all sample data into a plurality of cluster classes, and divide the sample data in each cluster class into the same certificate and the same type certificate.

[0034] The detection module is configured to judge, for each same certificate, whether the same certificate is a shared certificate, and if not, determine that the same certificate is a malicious certificate.

[0035] The detection module is further configured to judge, for each same type certificate, whether the same type certificate is a legitimate authorized certificate group, and if not, determine that the same type certificate is a malicious certificate.

[0036] In a third aspect, an embodiment of the present application provides a computer device, comprising a processor and a memory, the memory storing a computer program capable of being executed by the processor, and the processor being capable of executing the computer program to implement the certificate detection method according to the first aspect.

[0037] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, storing a computer program, which, when executed by a processor, implements the certificate detection method according to the first aspect.

[0038] The certificate detection method, device, computer device and computer readable storage medium provided by the embodiments of the present application analyze the identified one or more encryption protocols, extract a plurality of digital certificates and metadata of each digital certificate, normalize the metadata of each digital certificate into a sample data, obtain a sample set, perform clustering analysis on the sample set to divide all sample data into a plurality of clusters, further divide the sample data in each cluster into the same certificate and the same type of certificate, and then determine whether the same certificate and the same type of certificate are malicious certificates, that is, perform malicious determination on all digital certificates from the perspective of the same certificate and the same type of certificate, so as to realize longitudinal detection of digital certificates in the manner of correlation analysis of a plurality of digital certificates, thereby being able to identify unknown attack behaviors and greatly improving the detection effect and detection range.

[0039] In order to make the above objectives, characteristics and advantages of the present application more apparent, clear and easy to understand, the following will describe preferred embodiments in detail, and the accompanying drawings will be described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation to the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0041] Figure 1 Fig. 1 shows a communication schematic diagram of a client and a server provided by an embodiment of the present application.

[0042] Figure 2 Fig. 2 shows a block schematic diagram of a certificate detection system provided by an embodiment of the present application.

[0043] Figure 3 Fig. 3 shows a flow schematic diagram of a certificate detection method provided by an embodiment of the present application.

[0044] Figure 4 Fig. 4 shows one of the flow schematic diagrams of part of the sub-steps of step S15 in Fig. 3. Figure 3 Fig. 4 shows one of the flow schematic diagrams of part of the sub-steps of step S15 in Fig. 3.

[0045] Figure 5 A flowchart showing part of the sub-steps of step S15 is shown in Figure 2. Figure 3 A flowchart showing part of the sub-steps of step S15 is shown in Figure 2.

[0046] Figure 6 A block diagram of the certificate detection device according to an embodiment of the present application is shown.

[0047] Figure 7 A block diagram of the computer device according to an embodiment of the present application is shown.

[0048] Reference signs: 100 - certificate detection system; 110 - detection device; 120 - network device; 130 - certificate detection device; 140 - parsing module; 150 - normalization module; 160 - clustering module; 170 - detection module; 180 - computer device. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings can be arranged and designed in various different configurations.

[0050] Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0051] It should be noted that the relational terms such as "first" and "second" and the like are used only to distinguish one entity or operation from another, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "comprising", "including" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus including a series of elements includes not only those elements, but also other elements not explicitly listed or inherent to such a process, method, article or apparatus. Without more limitations, the element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus including the element.

[0052] Digital certificates are very common in encrypted communications, such as Figure 1As shown, the client and the server protect the integrity, non-repudiation and confidentiality of data through digital certificates.

[0053] In the process of encrypted data transmission, malicious traffic sometimes has problems in the use of digital certificates. At present, in the anomaly detection of digital certificates in encrypted traffic, the detection based on a single certificate or certificate chain can only reflect the certificate characteristics of the current session and cannot be associated with other sessions. As the technology of APT organizations becomes more and more mature, the forgery of digital certificates becomes more and more difficult to distinguish, and the detection is difficult to be effective. The certificate detection based on traditional machine learning classification algorithm can only identify the threat behaviors in the sample space trained according to known samples and derived therefrom, and cannot identify unknown threat behaviors.

[0054] Based on the above considerations, the embodiments of the present application provide a certificate detection method which can improve the problems of the current certificate detection method that the detection is difficult to be effective and the detection result is limited.

[0055] The certificate detection method provided by the embodiments of the present application can be applied to, for example, Figure 2 as shown in a certificate detection system 100, the certificate detection system 100 includes a detection device 110 and a plurality of network devices 120, the detection device 110 can be in communication connection with the plurality of network devices 120 through a network, and the plurality of network devices 120 can also be in communication connection through the network.

[0056] The detection device 110 is configured to obtain, from the network devices 120, session traffic between the network devices 120 and other network devices 120 as to-be-detected traffic, and obtain an encrypted protocol from each to-be-detected traffic.

[0057] It should be noted that the detection device 110 can actively capture the session traffic between the network devices 120, or the network devices 120 can actively upload the session traffic to the detection device 110.

[0058] The detection device 110 is further configured to implement the certificate detection method provided by the embodiments of the present application.

[0059] The detection device 110 includes but is not limited to: a standalone server, a server cluster and a computer terminal. The network devices 120 include but are not limited to: a standalone server, a server cluster, a personal computer, a notebook computer, a mobile phone, a mobile terminal, a wearable portable terminal, a vehicle-mounted terminal, a control terminal carried on a transportation device and a tablet computer, etc.

[0060] In one possible implementation, the embodiments of the present application provide a certificate detection method, with reference to Figure 3 The certificate detection method can include the following steps. In this embodiment, the certificate detection method is applied to Figure 2The detection device 110 in the network device 120 is exemplified.

[0061] S11, the encrypted protocol is parsed, and a plurality of digital certificates under the encrypted protocol are extracted, and the metadata of each digital certificate is extracted.

[0062] The encrypted protocol in this step S11 is the encrypted protocol identified from the to-be-detected traffic. The metadata of the digital certificate refers to the communication metadata, including but not limited to: server binary, certificate length, version number in the certificate, serial number, signature algorithm ID, issuer information, user information, start and end time, validity period, public key algorithm ID, public key, private key signature, and extension information.

[0063] S13, the metadata of each digital certificate is normalized, and the normalized metadata is taken as a sample data, and a sample set is obtained.

[0064] S15, the sample set is subjected to cluster analysis, all sample data is divided into a plurality of cluster classes, and the sample data in each cluster class is divided into the same certificate and the same type of certificate.

[0065] S17, for each same certificate, it is judged whether the same certificate is a shared certificate, and if not, the same certificate is determined to be a malicious certificate.

[0066] S19, for each same type of certificate, it is judged whether the same type of certificate is a legal authorized certificate group, and if not, the same type of certificate is determined to be a malicious certificate.

[0067] The detection device 110 obtains one or more session traffics between the network devices 120, parses each session traffic to obtain one or more encrypted protocols. Further, the detection device 110 can use deep packet inspection technology to parse each encrypted protocol to obtain a plurality of digital certificates under the encrypted protocol and the metadata of each digital certificate.

[0068] After obtaining the metadata of each digital certificate, the detection device 110 normalizes each metadata to process the metadata, especially the meaningful metadata such as whether there is a certain specific extension item in the digital certificate, the length of the validity period (the unit is hour) and the like into discrete numbers that can be recognized by the computer device 180 to obtain a sample data. Further, the sample data corresponding to the i-th digital certificate is recorded as , and the sample data corresponding to all metadata is constructed into a training set. The training set can be represented as: C={ , ,…, }.

[0069] Then, the detection device 110 performs cluster analysis on the training set to divide all sample data into multiple cluster classes, and divides the sample data in each cluster class into the same certificate and the same type of certificate, and then separately judges the same certificate and the same type of certificate to determine the malicious certificate.

[0070] Compared with the traditional certificate detection method, the above certificate detection method provided by the embodiment of the application divides all digital certificates into multiple same certificates and multiple same type of certificates, and judges the maliciousness of all digital certificates from the perspective of the same certificate and the same type of certificate, realizes the vertical detection of digital certificates in the mode of correlation analysis of multiple digital certificates, and can identify unknown attack behaviors, greatly improving the detection effect and detection range.

[0071] For step S11, in a possible implementation, it can be further implemented as: using a deep packet inspection technology to parse each encrypted protocol, extract the digital certificate chain of each encrypted protocol, obtain multiple digital certificates, and perform deduplication on all digital certificates, and decode each digital certificate after deduplication to extract the metadata of each digital certificate. The extracted digital certificate can be a labeled certificate.

[0072] It should be noted that when deduplicating all digital certificates, deduplication is performed based on the server binary tuple (such as <address, port>) of the digital certificate. When the other metadata of the digital certificate is the same and the server binary tuple of the digital certificate is the same, it is the same certificate. When the other metadata of the digital certificate is the same but the server binary tuple of the digital certificate is different, it is different certificates.

[0073] In actual application, the X509 digital certificate chain of each encrypted protocol can be extracted to obtain multiple digital certificates, all extracted digital certificates can be deduplicated, and each digital certificate chain after deduplication can be decoded by ASN.1 to obtain the metadata of each digital certificate.

[0074] The cluster analysis on the sample set can be flexibly selected, for example, it can be a k-means clustering algorithm, a Mean shift clustering algorithm, or any other clustering algorithm, and in the embodiment, it is not limited.

[0075] In a possible implementation, step S15 can be further implemented as: using a k-means clustering algorithm to perform cluster analysis on the sample set to divide all sample data into multiple cluster classes.

[0076] Further, referring to Figure 4 The above cluster analysis on the sample set using the k-means clustering algorithm can include the following steps.

[0077] S151, selecting preset number of sample data from the sample set as center points.

[0078] It should be noted that each center point corresponds to a cluster class.

[0079] S152, for each sample data, determining the nearest center point with the minimum distance from the sample data from all center points, and dividing the sample data into the cluster class corresponding to the nearest center point.

[0080] The distance between each sample data and any center point is calculated, and then the sample data is divided into the cluster class corresponding to the center point with the minimum distance between them.

[0081] S153, after dividing all sample data, calculating the center point of each cluster class.

[0082] S154, determining whether the preset clustering end condition is reached. If not, return to step S152, if yes, execute step S155.

[0083] S155, taking the plurality of cluster classes divided at present as the division result.

[0084] The preset end condition can also be flexibly selected, for example, the preset receiving conditions include but are not limited to: (1) the number of iterations reaches the maximum number of iterations; (2) the center point of the cluster class does not change. In the embodiment, no specific limitation is made.

[0085] For step S153, the way to calculate the center point of each cluster class can be flexibly set, for example, it can be calculated according to the preset rule, or it can be fitted by using neural network, and no specific limitation is made in the embodiment.

[0086] In one possible implementation, the center point calculation formula can be used to calculate the center point of each cluster class. The center point calculation formula can be represented as: wherein, represents the jth cluster class, represents the sample data in the jth cluster class, represents the center point of the jth cluster class.

[0087] Taking the sample set C={ , ,…, }, the preset number of step S151 is k, n=0, and the maximum number of iterations is N as an example.

[0088] 1) Select k points from the sample set C as initial center points, denoted as { , ,…, }.

[0089] 2) Calculate the distance between each sample data (i = 1, 2, …, m) and each center point (j = 1, 2, …, k) = If the distance between the sample data and the center point of the jth cluster is the smallest, the sample data is divided into the jth cluster, and . .

[0090] 3) After the division, recalculate the center points of all clusters .

[0091] 4) Determine whether the center points of the clusters are unchanged, and whether the number of iterations is equal to N. If one of the conditions is met, output the clustering result R = { , , …, }, otherwise repeat steps 2) and 3) until the center points do not change or the maximum number of iterations is reached.

[0092] If there is a server binary tuple in the sample data, the server binary tuple <address, port> can not participate in clustering analysis, but needs to be reserved in the form of identification.

[0093] Through the above steps S151 to S155, the cluster finally obtained satisfies that the similarity of digital certificates in the same cluster is the highest, that is, each sample data is divided into the cluster with the highest similarity, and that the similarity of all sample data (metadata of digital certificates) in the cluster is as high as possible, which helps to improve the detection effect.

[0094] Further, for step S15, the way of dividing the sample data in each cluster divided by clustering analysis into the same certificate and the same type of certificate can be flexibly set, for example, it can be divided according to a preset rule, or it can be divided according to similarity, which is not limited in the embodiment.

[0095] In a possible implementation method, referring to Figure 5 , the way of dividing the sample data in each cluster into the same certificate and the same type of certificate can be further implemented as the following steps.

[0096] S156, for each cluster, calculate the distance between each sample data in the cluster and the center point of the cluster.

[0097] S157, all sample data with a distance less than or equal to the first threshold value are regarded as the same certificate, and all sample data with a distance greater than the first threshold value are regarded as the same type of certificate.

[0098] For example, taking the first threshold value p as an example. For the cluster class R i , if the sample data c i in R j has a distance less than or equal to the threshold value p from the center point c i of the cluster class R l , the sample data c j is the same certificate as the center point c l , and all sample data with a distance less than or equal to p from the center point c l are the same certificate. If the sample data c j in R i has a distance greater than the threshold value p from the center point c l of the cluster class R j , it is determined that c l is the same type of certificate as c j , and the sample data c l is the same type of certificate as the center point c l , and all sample data with a distance greater than p from the center point c are the same type of certificate.

[0099] It should be understood that for a cluster class, there can be only the same certificate (i.e., all sample data has a distance less than or equal to the first threshold value from the center point), there can be only the same type of certificate (i.e., all sample data has a distance greater than the first threshold value from the center point), and there can be both the same certificate and the same type of certificate.

[0100] The manner of determining whether the same certificate is a shared certificate can be flexibly selected, for example, it can be determined according to a preset rule, or it can be determined according to a field of the same certificate, which is not specifically limited in the embodiment.

[0101] In a possible implementation, step S17 can be further implemented as: determining whether the same certificate is a multi-domain name certificate or a wildcard certificate, if yes, determining that the same certificate is a shared certificate, and if not, determining that the same certificate is a malicious certificate.

[0102] The wildcard certificate, also known as the universal domain name certificate, can support unlimited subdomain names and one global domain name, and has no server installation quantity limit, meaning that maximum security can be provided in all subdomains without paying additional SSL. For example, *.gworg.com, blog.gworg.com, subdomain.gworg.com, and anything.gworg.com.

[0103] Multi-domain name certificate, which can contain multiple domain names (Subject Alternative Name) in one SSL certificate, supports multiple different domain names. Multi-domain name SSL certificate can include at least 2 domain names and at most 150 domain names.

[0104] For the same certificate, the metadata corresponding to a sample data belonging to the same certificate can be randomly extracted, the extension item field (i.e. SubjectAltName field) of the certificate extension information is extracted from the metadata, it is judged whether the extension item field belongs to the field of multi-domain name certificate or wildcard certificate, if yes, it is determined that the same certificate is a shared certificate, otherwise, it is determined that the same certificate is a malicious certificate.

[0105] Similarly, the way of judging whether the same type of certificate is a shared certificate can be flexibly selected, for example, one sample data can be randomly extracted and judged according to the preset rule, or all sample data in the same type of certificate can be judged according to the preset rule, which is not limited in the embodiment.

[0106] In a possible implementation, the detection device pre-stores a legal certificate library recording certificate information of a legal authorized certificate, and on this basis, step S19 can be further implemented as: a sample data is randomly extracted from the same type of certificate, it is judged whether the sample data matches the certificate information in the legal certificate library, if yes, it is determined that the same type of certificate is a legal authorized certificate group, if not, it is determined that the same type of certificate is a malicious certificate.

[0107] In order to improve the detection accuracy, in other embodiments, the same type of certificate is determined to be a legal authorized certificate group only when the metadata of each digital certificate in the same type of certificate matches a certificate information in the legal certificate library.

[0108] The certificate detection method provided by the embodiment of the application can obtain a plurality of digital certificates by analyzing the encrypted protocol, and can cluster and analyze the digital certificates according to the metadata, divide a plurality of clusters, and then judge whether the digital certificates in the clusters are the same certificate and / or the same type of certificate. According to different rules, the same certificate and the same type of certificate are maliciously determined, the unknown malicious attack behavior in the encrypted traffic is detected according to the analysis result of the certificate clustering reuse, and the attack behavior corresponding to the same type of certificate clustering reuse can be associated and analyzed.

[0109] Based on the same inventive concept of the above certificate detection method, in a possible implementation, the embodiment of the application further provides a certificate detection device 130, which can be applied to the detection device 110 in Figure 2 . Refer to Figure 6The certificate detection apparatus 130 can include a parsing module 140, a normalization module 150, a clustering module 160, and a detection module 170.

[0110] The parsing module 140 is configured to parse the encrypted protocol, extract a plurality of digital certificates under the encrypted protocol, and extract metadata of each digital certificate. The encrypted protocol is an encrypted protocol identified from the to-be-detected traffic.

[0111] The normalization module 150 is configured to normalize the metadata of each digital certificate, and take the normalized metadata as a sample data to obtain a sample set.

[0112] The clustering module 160 is configured to perform clustering analysis on the sample set, divide all sample data into a plurality of cluster classes, and divide the sample data in each cluster class into same certificates and same-type certificates.

[0113] The detection module 170 is configured to determine, for each same certificate, whether the same certificate is a shared certificate. If not, the same certificate is determined to be a malicious certificate.

[0114] The detection module 170 is further configured to determine, for each same-type certificate, whether the same-type certificate is a group of legitimate authorized certificates. If not, the same-type certificate is determined to be a malicious certificate.

[0115] In the certificate detection apparatus 130, all digital certificates are divided into a plurality of same certificates and a plurality of same-type certificates through the cooperative action of the parsing module 140, the normalization module 150, the clustering module 160, and the detection module 170, and malicious determination is performed on all digital certificates in terms of same certificates and same-type certificates, thereby realizing longitudinal detection of digital certificates in the manner of correlation analysis of a plurality of digital certificates, so as to identify unknown attack behaviors and greatly improve the detection effect and detection range.

[0116] The specific limitations of the certificate detection apparatus 130 can refer to the limitations of the certificate detection method in the foregoing, and will not be described herein. Each module in the certificate detection apparatus 130 can be realized by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a memory of the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to each module.

[0117] In an embodiment, a computer device 180 is provided, which can be a server, and an internal structure diagram of the computer device 180 can be as shown in FIG. 2. Figure 7The computer device 180 includes a processor, a memory, a communication interface, a display screen and an input device connected by a system bus. The processor of the computer device 180 is configured to provide computing and control capabilities. The memory of the computer device 180 includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device 180 is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved through WIFI, a carrier network, near field communication (NFC) or other technologies. The computer program is executed by the processor to implement the certificate detection method provided in the above embodiments.

[0118] Figure 7 The structure shown in FIG. 8 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device 180 to which the scheme of the present application is applied. Specifically, the computer device 180 can include more or fewer components than those shown in FIG. 8, or combine certain components, or have a different arrangement of components. Figure 7

[0119] In an embodiment, the certificate detection apparatus 130 provided by the present application can be implemented in the form of a computer program, which can run on a computer device 180 as shown in FIG. 8. The memory of the computer device 180 can store various program modules constituting the certificate detection apparatus 130, such as the parsing module 140, the normalization module 150, the clustering module 160 and the detection module 170 shown in FIG. 8. The computer program constituted by the various program modules enables the processor to perform the steps in the certificate detection method described in the specification. Figure 7 Figure 6 For example, the computer device 180 can perform step S11 through the parsing module 140 in the certificate detection apparatus 130 as shown in FIG. 8. The computer device 180 can perform step S13 through the normalization module 150. The computer device 180 can perform step S15 through the clustering module 160. The computer device 180 can perform steps S17 and S19 through the detection module 170.

[0120] Figure 7 Figure 6

[0121] ​​​​​In one embodiment, a computer device 180 is provided, comprising a memory and a graphic processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program: parsing an encryption protocol, extracting a plurality of digital certificates under the encryption protocol, and extracting metadata of each digital certificate; normalizing the metadata of each digital certificate, taking the normalized metadata as a sample data, and obtaining a sample set; performing cluster analysis on the sample set, dividing all sample data into a plurality of cluster classes, and dividing the sample data in each cluster class into same certificates and same type certificates; for each same certificate, judging whether the same certificate is a shared certificate, if not, determining that the same certificate is a malicious certificate; for each same type certificate, judging whether the same type certificate is a legal authorized certificate group, if not, determining that the same type certificate is a malicious certificate.

[0122] In one embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a graphic processor to implement the following steps: parsing an encryption protocol, extracting a plurality of digital certificates under the encryption protocol, and extracting metadata of each digital certificate; normalizing the metadata of each digital certificate, taking the normalized metadata as a sample data, and obtaining a sample set; performing cluster analysis on the sample set, dividing all sample data into a plurality of cluster classes, and dividing the sample data in each cluster class into same certificates and same type certificates; for each same certificate, judging whether the same certificate is a shared certificate, if not, determining that the same certificate is a malicious certificate; for each same type certificate, judging whether the same type certificate is a legal authorized certificate group, if not, determining that the same type certificate is a malicious certificate.

[0123] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are only schematic, for example, the flowcharts and block diagrams in the drawings show the possible implementation architectures, functions and operations of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logical function. It should also be noted that, in some alternative implementations, the functions noted in the blocks can occur in different orders from those described in the drawings. For example, two consecutive blocks can actually be executed in a substantially parallel manner, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system for implementing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0124] In addition, each functional module in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0125] If the functions are implemented in the form of software functional modules and sold or used as independent products, they can be stored in a storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0126] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A certificate detection method characterized by comprising: The method comprises: parsing an encryption protocol, extracting a plurality of digital certificates under the encryption protocol, and extracting metadata of each of the digital certificates; wherein the encryption protocol is an encryption protocol identified from the to-be-detected traffic; normalizing the metadata of each of the digital certificates, and taking the normalized metadata as a sample data to obtain a sample set; performing cluster analysis on the sample set, dividing all the sample data into a plurality of cluster classes, and calculating the distance between each of the sample data in the cluster class and the center point of the cluster class for each of the cluster classes; taking all the sample data with a distance less than or equal to a first threshold value as the same certificate, and taking all the sample data with a distance greater than the first threshold value as the same type of certificate; judging whether each of the same certificate is a shared certificate, and if not, determining that the same certificate is a malicious certificate; judging whether each of the same type of certificate is a legal authorized certificate group, and if not, determining that the same type of certificate is a malicious certificate.

2. The certificate detection method according to claim 1, characterized by, The method of performing cluster analysis on the sample set and dividing all the sample data into a plurality of cluster classes comprises: using a k-means clustering algorithm to perform cluster analysis on the sample set to divide all the sample data into a plurality of cluster classes.

3. The certificate detection method according to claim 2, characterized by, The step of using a k-means clustering algorithm to perform cluster analysis on the sample set to divide all the sample data into a plurality of cluster classes comprises: selecting a preset number of sample data from the sample set as center points; each of the center points corresponds to a cluster class; for each of the sample data, determining the nearest center point with the smallest distance from all the center points, and dividing the sample data into the cluster class corresponding to the nearest center point; after dividing all the sample data, calculating the center point of each of the cluster classes, and judging whether a preset cluster end condition is reached; if yes, taking the plurality of cluster classes currently divided as a division result; if no, returning to the step of determining the nearest center point with the smallest distance from all the center points for each of the sample data.

4. The certificate detection method according to claim 3, characterized by, The step of calculating the center point of each of the cluster classes comprises: using a center point calculation formula to calculate the center point of each of the cluster classes. The center point calculation formula includes: wherein, represents the jth cluster class, represents the sample data in the jth cluster class, represents the center point of the jth cluster class.

5. The certificate detection method according to claim 1, characterized by, The step of judging whether the same certificate is a shared certificate comprises: judging whether the same certificate is a multi-domain name certificate or a wildcard certificate, and if yes, determining that the same certificate is a shared certificate, and if not, determining that the same certificate is a malicious certificate.

6. The certificate detection method according to claim 1, characterized by, The step of judging whether the same type of certificate is a legal authorized certificate group comprises: randomly extracting the metadata of a digital certificate from the same type of certificate, judging whether the metadata matches the certificate information in a legal certificate library, and if yes, determining that the same type of certificate is a legal authorized certificate group, and if not, determining that the same type of certificate is a malicious certificate.

7. A certificate detection apparatus characterized by comprising: The method comprises a parsing module, a normalization module, a clustering module, and a detection module. The analysis module is configured to analyze an encryption protocol, extract a plurality of digital certificates under the encryption protocol, and extract metadata of each digital certificate, wherein the encryption protocol is an encryption protocol identified from the to-be-detected traffic; The normalization module is configured to normalize the metadata of each digital certificate, take the normalized metadata as a sample data, and obtain a sample set; The clustering module is configured to perform clustering analysis on the sample set, divide all the sample data into a plurality of cluster classes, calculate, for each cluster class, a distance between each sample data in the cluster class and a center point of the cluster class, take all sample data with a distance less than or equal to a first threshold value as a same certificate, and take all sample data with a distance greater than the first threshold value as a same type certificate; The detection module is configured to determine, for each same certificate, whether the same certificate is a shared certificate, and if not, determine that the same certificate is a malicious certificate; The detection module is further configured to determine, for each same type certificate, whether the same type certificate is a legitimate authorized certificate group, and if not, determine that the same type certificate is a malicious certificate.

8. A computer device, comprising: The computer program is executed by the processor to implement the certificate detection method of any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the certificate detection method of any one of claims 1 to 6.

Images