Certificate detection method and device, electronic equipment and computer storage medium

Abstract

The invention discloses a certificate detection method and device, electronic equipment and a computer storage medium. The method comprises the following steps: acquiring a certificate to be detected; performing data preprocessing on the certificate to be detected to obtain target feature metadata, the target feature metadata comprising a target certificate fingerprint; judging whether the target certificate fingerprint exists in a preset fingerprint database or not; and if the target certificate fingerprint does not exist in the preset fingerprint database, inputting the target feature metadata into the malicious certificate detection model, and outputting a target detection result. According to the certificate detection method, a traditional certificate fingerprint database and a machine learning method are combined, automatic and accurate detection of the malicious certificates is realized, the malicious certificate detection efficiency is improved, the problem of missing detection of the malicious certificates is avoided, and the comprehensiveness of certificate detection is improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a certificate detection method, device, electronic device and computer storage medium. Background Art

[0002] According to statistics, the proportion of encrypted traffic in current Internet traffic has exceeded 80%, and this figure is expected to continue to grow rapidly. The Transport Layer Security (TLS) protocol is often used to provide data security and integrity in network communications. In the TLS protocol, the X.509 certificate is the basis of the protocol and is issued by a trusted digital certificate authority CA after verifying the server identity. It has server identity authentication and data transmission encryption functions to ensure that the encrypted connection between the communicating parties is secure.

[0003] However, this also gives criminals an opportunity to a certain extent. They often use certificates to encrypt data to hide their true intentions and evade review and detection. According to Zscaler's "2022 Crypto Attack Status Report", more than 85% of network attacks (including phishing, C&C attacks, etc.) began to use X.509 certificates to transmit data and disguise themselves, while the traditional method of detecting malicious certificates by building a malicious certificate fingerprint library can only identify existing known malicious certificates, and it is difficult to identify newly emerging malicious certificates. In addition, it is difficult to collect malicious certificates. This method is more time-consuming and labor-intensive, and may cause the problem of missing malicious certificates. Summary of the invention

[0004] The embodiments of the present application provide a certificate detection method, device, electronic device and computer storage medium, which combine the traditional detection method of building a fingerprint library with the detection method based on machine learning, improve the certificate detection efficiency to a certain extent, reduce the computational complexity of the malicious certificate detection model, avoid the missed detection problem caused by unknown malicious certificates not being collected, and improve the comprehensiveness and accuracy of certificate detection.

[0005] In a first aspect, an embodiment of the present application provides a certificate detection method, comprising:

[0006] Obtain the certificate to be tested;

[0007] Performing data preprocessing on the certificate to be detected to obtain target feature metadata; the target feature metadata includes the target certificate fingerprint corresponding to the certificate to be detected;

[0008] Determine whether the target certificate fingerprint exists in a preset fingerprint library; the preset fingerprint library includes certificate fingerprints with known detection results;

[0009] If the target certificate fingerprint does not exist in the preset fingerprint library, the target feature metadata is input into the malicious certificate detection model, and the target detection result corresponding to the certificate to be detected is output; the malicious certificate detection model is trained based on a certificate sample data set with known detection results.

[0010] In a second aspect, an embodiment of the present application provides a certificate detection device, including:

[0011] An acquisition module is used to obtain the certificate to be tested;

[0012] A preprocessing module, used to perform data preprocessing on the certificate to be detected to obtain target feature metadata; the target feature metadata includes a target certificate fingerprint corresponding to the certificate to be detected;

[0013] A judgment module, used to judge whether the target certificate fingerprint exists in a preset fingerprint library; the preset fingerprint library includes certificate fingerprints with known detection results;

[0014] The detection module is used to input the target feature metadata into the malicious certificate detection model if the target certificate fingerprint does not exist in the preset fingerprint library, and output the target detection result corresponding to the certificate to be detected; the malicious certificate detection model is trained based on a certificate sample data set with known detection results.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory; wherein the memory stores executable program code, and the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method steps provided in the first aspect of the embodiment of the present application.

[0016] In a fourth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method steps provided in the first aspect of the embodiment of the present application.

[0017] The beneficial effects brought about by the technical solutions provided by some embodiments of the present application include at least:

[0018] The embodiment of the present application proposes a joint identification method, which combines the traditional identification method of building a fingerprint library with the identification method based on machine learning. It first determines whether the target certificate fingerprint corresponding to the certificate to be detected exists in the preset fingerprint library. If not, the target feature metadata of the certificate to be detected is input into the malicious certificate detection model for detection. Compared with the traditional method of detecting malicious certificates by building a malicious certificate fingerprint library, the method of the embodiment of the present application can not only first search for the target certificate fingerprint corresponding to the certificate to be detected in the preset fingerprint library, to a certain extent, improve the certificate detection efficiency and reduce the calculation amount of the malicious certificate detection model, but also use the malicious certificate detection model to accurately and efficiently detect unknown malicious certificates, avoid the problem of missed detection caused by unknown malicious certificates not being collected, and improve the comprehensiveness and accuracy of certificate detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A network architecture diagram of a certificate detection system provided in an embodiment of the present application;

[0021] Figure 2 A flow chart of a certificate detection method provided in an embodiment of the present application;

[0022] Figure 3 A schematic diagram of a training process of a malicious certificate detection model provided in an embodiment of the present application;

[0023] Figure 4 A flowchart of another certificate detection method provided in an embodiment of the present application;

[0024] Figure 5 A schematic diagram of the structure of a certificate detection device provided in an embodiment of the present application;

[0025] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0027] In the description of the present application, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood in specific circumstances. In addition, in the description of the present application, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are an "or" relationship. In addition, the terms "include" and "have" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices.

[0028] Please refer to the following Figure 1 , which exemplarily shows a structural diagram of a certificate detection system provided in an embodiment of the present application. Figure 1 As shown, the certificate detection system may include: a terminal cluster and a server 120. Specifically, the terminal cluster may include one or more terminals, wherein the multiple terminals may include a terminal 110a, a terminal 110b, a terminal 110c, etc. Any terminal in the terminal cluster may establish a data relationship with the network, and establish a data connection relationship with the server 120 through the network. Any terminal in the terminal cluster may be, but is not limited to, a mobile phone, a tablet computer, a laptop computer, and other devices.

[0029] The server 120 may be a server that can provide certificate detection. It may receive a certificate to be detected sent by any terminal in a terminal cluster through a network, and perform data preprocessing on the certificate to be detected to obtain target feature metadata, wherein the target feature metadata includes a target certificate fingerprint corresponding to the certificate to be detected. Then, it is determined whether the target certificate fingerprint is in a preset fingerprint library. If not, the target feature metadata is input into a malicious certificate detection model, and a target detection result corresponding to the certificate to be detected is output.

[0030] Optionally, the server 120 may also send data such as target detection results corresponding to the certificate to be detected to any terminal in the terminal cluster through the network. The server 120 may be, but is not limited to, a hardware server, a virtual server, a cloud server, and the like.

[0031] It can be understood that the above-mentioned certificate detection can be performed by the above-mentioned server 120, and can also be performed by the above-mentioned terminal. The embodiments of the present application are not limited to this. The following embodiments are all described by taking the example of the server 120 performing the above-mentioned certificate detection.

[0032] The network may be a medium that provides a communication link between the server 120 and any terminal in the terminal cluster, or may be the Internet including network devices and transmission media, but is not limited thereto. The transmission medium may be a wired link, such as but not limited to a coaxial cable, an optical fiber, and a digital subscriber line (DSL), or may be a wireless link, such as but not limited to wireless fidelity (WIFI), Bluetooth, and a mobile device network.

[0033] Understandably, Figure 1 The number of terminal clusters and servers 120 in the certificate detection system shown is only an example. In a specific implementation, the certificate detection system may include any number of terminals and servers. This embodiment of the application does not specifically limit this. For example, but not limited to, the server 120 may be a server cluster consisting of multiple servers.

[0034] Please refer to the following Figure 2 , which exemplarily shows a flow chart of a certificate detection method provided in an embodiment of the present application. Figure 2 As shown, the certificate detection method may include the following steps:

[0035] S201: Obtain the certificate to be tested.

[0036] Optionally, when the user wants to know whether the certificate to be tested is malicious, the user can use the user terminal to send the certificate to be tested to the server through the network. Then, the server 120 can receive the certificate to be tested sent by the user terminal through the network. The above-mentioned certificate to be tested can be, but is not limited to, an X.509 digital certificate, which is issued by an authoritative certificate authority (CA) and is an electronic file used to verify the identity of the communication entity and protect the confidentiality and integrity of data in Internet communications. It provides a way to verify the identity of the communication entity on the Internet to ensure the safe and correct transmission of information.

[0037] Optionally, when the user terminal exchanges data with the target business system, the user terminal receives the traffic data to be detected sent by the target business system, and divides the traffic data to be detected to obtain a target session flow, for example but not limited to dividing according to the four-tuple <source IP, source port number, destination IP, destination port number> to obtain at least one target session flow; then, the certificate to be detected is restored from the at least one target session flow using a file restoration technology. The certificate restoration process can be implemented but not limited to using a data packet analysis tool, and each target session flow can contain one or more certificates to be detected.

[0038] Exemplarily, for the target business system to be detected, the user terminal and the server of the target business system perform handshake according to the TLS / SSL security protocol, and the server of the target business system sends an X.509 digital certificate to the user terminal during the TLS / SSL handshake process, that is, the X.509 digital certificate is located in the TLS / SSL session flow. Usually, a network packet capture tool (such as but not limited to Wireshark) can be used to capture the TLS / SSL session flow and obtain the X.509 digital certificate. Specifically, first use a network packet capture tool to capture all data packets on the network, which contain detailed information about network communications, including IP addresses, port numbers, and possible TLS / SSL session data. In the captured data packets, the TLS / SSL session flow data is identified by checking the protocol type (such as but not limited to TLS / SSL on TCP) and port number (such as but not limited to HTTPS port 443) of the data packet. After obtaining the TLS / SSL session flow data, the four-tuple <source IP, source port number, destination IP, destination port number> can be used to segment different session flows. Each unique four-tuple combination represents an independent TLS / SSL session flow. Next, use a packet analysis tool to analyze each TLS / SSL session flow, including viewing the session handshake process, encrypted data transmission, and the digital certificates carried. Finally, save the X.509 digital certificate data as a certificate file to be tested with the suffix .cer for subsequent certificate testing. Each TLS / SSL session flow can contain one or more digital certificates.

[0039] It can be understood that the above-mentioned X.509 digital certificate acquisition process is only an example. In a specific implementation, the X.509 digital certificate can be obtained in any way, and the embodiments of the present application do not specifically limit this.

[0040] S202: Perform data preprocessing on the certificate to be detected to obtain target feature metadata, where the target feature metadata includes a target certificate fingerprint.

[0041] Optionally, the target feature metadata may also include but is not limited to target non-fingerprint features, and the target non-fingerprint features may include but are not limited to at least one of the following: certificate version, certificate signature hash algorithm, certificate public key length, number of certificate aliases, certificate validity period, certificate validity value, self-signed certificate value, certificate domain name matching value, certificate verification status, certificate security level, low credibility of the certificate authority, entropy value of the certificate user CN field, entropy value of the certificate issuer CN field, and number of certificate extension items.

[0042] Optionally, after obtaining the certificate to be tested, it can be parsed first to obtain the target certificate metadata; then, feature engineering is performed on the target certificate metadata to obtain the target feature metadata. For example, but not limited to, after obtaining the certificate to be tested with the suffix .cer, use the "openssl x509-in certificate.crt-text-noout" command of the OpenSSL open source toolkit to parse the certificate to be tested in the command line. Among them, "certificate.crt" is the name of the certificate file to be parsed. This command will print out the detailed information of the certificate. The target certificate metadata obtained after parsing may include, but is not limited to: a) the Secure Hash Algorithm 1 (SHA-1) value of the certificate, that is, the target certificate fingerprint; b) the version number of the certificate; c) the signature hash algorithm of the certificate; d) the length of the public key of the certificate; e) the alias of the certificate; f) the user-related field information of the certificate; g) the issuer-related field information of the certificate; h) the validity period of the certificate; i) the certificate chain and other information. The embodiment of the present application does not limit the method of parsing the certificate and the content of the target certificate metadata.

[0043] The feature engineering of the target certificate metadata is to convert non-numeric features into numerical representations, so as to facilitate the subsequent input of the malicious certificate detection model as the target feature for detection. Furthermore, the certificate fingerprint can be, but is not limited to, the certificate SHA-1 value. The certificate version value usually has different values ​​such as V1, V2, and V3. In the feature engineering stage, mapping will be performed: V1: 0, V2: 1, V3: 2. The signature hash algorithm of the certificate is usually diverse. At present, some signature algorithms have some security vulnerabilities (such as MD2). In the feature engineering stage, it will be determined whether the signature hash algorithm is a secure signature hash algorithm. If it is a secure signature hash algorithm, it is 1, otherwise it is 0. The certificate validity value is determined by judging whether the certificate is valid under the traffic timestamp. If it is valid, the value is set to 1, otherwise it is set to 0. The self-signed certificate value is determined by judging whether the fields of the issuer and the user in the certificate metadata are exactly the same. If they are exactly the same, the value is set to 1, otherwise it is 0. The certificate domain name matching value is determined by judging whether the server name in the TLS / SSL session flow Client hello is in the certificate alias. If the server name is in the certificate alias, the certificate domain name and the traffic domain name match, and the value is set to 1, otherwise it is set to 0. The server name parameter is obtained when obtaining the session flow where the certificate is located. There are 6 certificate verification states, which are mapped here respectively: (1) No certificate: -1, (2) OK: 0, (3): self-signed certificate: 1, (4) self-signed certificate in certificate chain: 2, (5): unable to get local issuer certificate: 3, (6) other return values: 4. There are three security levels for the certificate, from low to high, namely DV (Domain Validation), OV (Organization Validation) and EV (Extended Validation). For criminals, they usually do not apply for certificates with higher security levels. Mapping will be performed in the feature engineering stage: DV: 0, OV: 1, EV: 2. The low credibility of the certificate issuing authority is determined by judging whether the certificate issuer is from a low credibility issuing authority, and if so, the value is set to 1, otherwise it is set to 0. The embodiment of the present application does not limit the feature engineering mapping method.

[0044] Please continue to refer to Figure 2 ,like Figure 2 As shown, in the above S202, after the certificate to be detected is preprocessed to obtain target feature metadata, wherein the target feature metadata includes the target certificate fingerprint, the certificate detection method further includes:

[0045] S203: Determine whether the target certificate fingerprint exists in a preset fingerprint database.

[0046] Specifically, after the certificate to be detected has been preprocessed to obtain the corresponding target certificate fingerprint, it can be searched in the preset fingerprint library to see if there is a certificate fingerprint that is consistent with the target certificate fingerprint. The above-mentioned preset fingerprint library may include, but is not limited to, at least one of the following: a malicious certificate fingerprint library and a detected certificate fingerprint library; the malicious certificate fingerprint library includes certificate fingerprints of multiple malicious certificates, and the detected certificate fingerprint library includes the detected certificate fingerprint and the detection results corresponding to the detected certificate fingerprint. Among them, the certificate fingerprint in the malicious certificate fingerprint library may be, but is not limited to, from the certificate fingerprint corresponding to the pre-collected malicious network traffic, and the above-mentioned malicious network traffic may include, but is not limited to: zombies, Trojans, worms, APT, etc. The detected certificate fingerprint may be a certificate fingerprint that has been detected by the malicious certificate detection model of the embodiment of the present application, or it may be a certificate fingerprint that has been detected by other methods or a certificate fingerprint of a known detection result obtained from the network, and the embodiment of the present application does not limit this. At the same time, the detection results corresponding to the detected certificate fingerprint include malignant and benign.

[0047] S204: If the target certificate fingerprint does not exist in the preset fingerprint library, the target feature metadata is input into the malicious certificate detection model, and the target detection result is output.

[0048] Specifically, if the target certificate fingerprint does not exist in the preset fingerprint library, it means that the certificate to be detected corresponding to the target certificate fingerprint is a certificate of unknown attributes (malignant or benign), then a machine learning-based method can be used to detect the certificate, that is, the target feature metadata can be input into the malicious certificate detection model to output the target detection result. For example, but not limited to, relevant features are extracted through the model algorithm for prediction, and finally the classification score is calculated, and the score range is [0,1]. If the score exceeds the threshold (for example, but not limited to 0.5), the output is 1, indicating that the certificate to be detected is a malicious certificate. If the score is less than or equal to 0.5, the output is 0, indicating that the certificate to be detected is a benign certificate. The above-mentioned malicious certificate detection model is trained based on a certificate sample data set with known detection results.

[0049] Optionally, if the target certificate fingerprint does not exist in the preset fingerprint library, the target non-fingerprint feature can be input into the pre-trained malicious certificate detection model to obtain the target detection result. Because the certificate fingerprint is a hash value randomly generated according to the certificate content, it can serve as a unique identifier, but due to the random generation of the certificate fingerprint, it can only exist as noise in the malicious certificate detection model. Therefore, when selecting the input features of the malicious certificate detection model, you can only choose to use the target non-fingerprint features as input features instead of the certificate fingerprint as input features, thereby reducing unnecessary computing power consumption generated by the malicious certificate detection model during training and prediction.

[0050] The embodiment of the present application proposes a joint identification method, which combines the traditional identification method of building a fingerprint library with the identification method based on machine learning. It first determines whether the target certificate fingerprint corresponding to the certificate to be detected exists in the preset fingerprint library. If not, the target feature metadata of the certificate to be detected is input into the malicious certificate detection model for detection. Compared with the traditional method of detecting malicious certificates by building a malicious certificate fingerprint library, the method of the embodiment of the present application can not only first search for the target certificate fingerprint corresponding to the certificate to be detected in the preset fingerprint library, to a certain extent, improve the certificate detection efficiency and reduce the calculation amount of the malicious certificate detection model, but also use the malicious certificate detection model to accurately and efficiently detect unknown malicious certificates, avoid the problem of missed detection caused by unknown malicious certificates not being collected, and improve the comprehensiveness and accuracy of certificate detection.

[0051] Please refer to the following Figure 3 , which exemplarily shows a training flow diagram of a malicious certificate detection model provided in an embodiment of the present application. Figure 3 As shown in the figure, the malicious certificate detection model training includes the following steps:

[0052] S301: Obtain a benign certificate and a malignant certificate.

[0053] Exemplarily, the collection of malicious certificates first obtains the SHA-1 value of the malicious certificate from abuse.ch, where abuse.ch is a security agency for malware. Then manually retrieve the certificate file in pem format corresponding to the SHA-1 value in censys. Benign certificates are obtained by scanning the certificates of the top one million web pages ranked by Alexa. First, a list of URLs is obtained from Alexa, and then the "openssl s_client" command is used to scan and obtain its certificate file. The process of benign data collection uses OpenSSL to crawl certificates. OpenSSL is an open source toolkit for TLS and SSL protocols. The s_client component of OpenSSL is used to query domain names and obtain certificate information. S_client connects to the specified domain on port 443 and retrieves the certificate. The certificate and other information about the connection will be obtained, and finally the certificate file will be obtained. An independent automatic script can be implemented using the Python programming language to collect benign certificates. Using this script can greatly save the time of downloading digital certificates according to the website domain name. The files initially downloaded by malicious certificates and benign certificates are encrypted files in pem format.

[0054] S302: Construct a certificate sample data set.

[0055] Exemplarily, the obtained benign certificates and malicious certificates can be parsed by OpenSSL instructions to obtain certificate metadata, and then feature engineering can be performed on the certificate metadata to obtain feature metadata. The obtained malicious certificate feature metadata and benign certificate meta-feature data are then mixed and shuffled, and then divided into training set, verification set and test set in a ratio of 6:2:2. The training set is used to train model parameters, the verification set is used to verify the model training effect during the training phase to avoid overfitting, and the test set is used to judge the quality of the model. The parsing process and feature engineering process of S302 are consistent with S202 and will not be repeated here. In the embodiment of the present application, there is no limitation on the ratio of data set division.

[0056] S303: Input the certificate sample data set into the malicious certificate detection model for training.

[0057] Exemplarily, in this step, the malicious certificate detection model used can be, but is not limited to, a convolutional neural network (CNN). CNN can extract feature information from the data through convolution kernels. These features can be artificially designed or obtained through training. CNN uses a design mechanism of local connection and weight sharing to reduce the parameter scale in the network and enable the network to have better feature extraction capabilities. The sample data set is divided proportionally and input into CNN for training. The label of the data is whether it is a malicious certificate. If it is a malicious certificate, the label is 1, and if it is a benign certificate, the label is 0. The loss function value is calculated by predicting the label and the true label to adjust the model parameters. At the same time, in order to reduce the generalization error of the model, the K-fold cross-validation method is used to select the model with the most appropriate hyperparameters.

[0058] S304: Calculate the loss function.

[0059] Exemplarily, the deep learning model training uses the convergence of the loss function as the training goal. The loss function used in this step can be, but is not limited to, the cross entropy loss function. Since the final detection results of the malicious certificate detection model have only two types, namely, malicious certificates and non-malicious certificates, which belongs to a binary classification problem, the binary cross entropy loss function is used as the objective function of the embodiment of the present application. The loss function calculation formula is as follows:

[0060] Loss=-[ylog(p)+(1-y)log(1-p)]

[0061] Where y is the true label (0 or 1), and P is the probability of the model predicting the positive class. In a binary classification problem, if the probability p predicted by the model is close to 0 or 1, and the true label y is also 0 or 1, the value in the logarithmic function will be very small, so the output of the logarithmic function will also be close to 0. In this case, the loss function Loss value will also be small.

[0062] S305: Determine whether the loss function converges. If so, execute S307; if not, execute S306.

[0063] Specifically, during the training process, the binary cross entropy loss function of S304 is used as the objective function of the model training. The closer the loss function value Loss is to 0, the better the model training effect is. After multiple rounds of training, the loss function value gradually tends to be stable, which means that the loss function has converged.

[0064] S306: Update model parameters using the optimizer.

[0065] Specifically, during the model training process, the value of the loss function is calculated in each round, and it is determined whether the loss function converges. If not, the optimizer (which may be but is not limited to AdamW) is used to update the parameters of the model, such as weights and biases, and then S303 is executed to perform a new round of training. AdamW calculates gradients and updates parameters, and the updates involved include weight decay for each parameter. This is a regularization method that achieves the effect of regularization by limiting the norm of the weight parameter, thereby improving the generalization performance of the model. This regularization technique is called "weight decay" (WeightDecay), which adds a decay term in the parameter update process so that the model does not rely too much on training data during the training process, thereby improving the generalization ability of the model. In the embodiment of the present application, the optimizer used in the malicious certificate detection model is not limited.

[0066] S307: End training and save the model.

[0067] Specifically, after the loss function converges, it means that the parameters of the malicious certificate detection model have also reached the optimal level. At this time, the model is saved as a pre-trained malicious certificate detection model to detect unknown certificates.

[0068] Please refer to the following Figure 4 , which exemplarily shows a flow chart of another certificate detection method provided in an embodiment of the present application. Figure 4 As shown, the certificate detection method includes the following steps:

[0069] S401: Obtain the certificate to be tested.

[0070] Specifically, S401 is consistent with S201 and will not be described in detail here.

[0071] S402: Preprocess the certificate to be tested to obtain target feature metadata.

[0072] Specifically, S402 is consistent with S202 and will not be repeated here.

[0073] S403: Determine whether the target certificate fingerprint exists in the malicious certificate fingerprint library.

[0074] Specifically, the target feature metadata may include, but is not limited to, a target certificate fingerprint and a target non-fingerprint feature. The target certificate fingerprint may uniquely identify the certificate to be detected. After obtaining the target certificate fingerprint corresponding to the certificate to be detected, the target certificate fingerprint may be first searched in the malicious certificate fingerprint library to determine whether it exists.

[0075] S404: If the target certificate fingerprint exists in the malicious certificate fingerprint library, it is determined that the certificate to be detected is a malicious certificate.

[0076] Specifically, since the certificate fingerprint is unique, when the target certificate fingerprint exists in the malicious certificate fingerprint library, it means that the certificate to be detected corresponding to the target certificate fingerprint is a malicious certificate. In this way, it can be directly determined that the certificate to be detected is a malicious certificate without the need for subsequent model detection steps. This avoids repeated detection of malicious certificates and improves the efficiency of certificate detection.

[0077] Please continue to refer to Figure 4 ,like Figure 4 As shown, after the above S402: preprocessing the certificate to be detected to obtain target feature metadata, the certificate detection method further includes:

[0078] S405: Determine whether the target certificate fingerprint exists in the detected certificate fingerprint library.

[0079] Specifically, after obtaining the target certificate fingerprint corresponding to the certificate to be detected or if the target certificate fingerprint does not exist in the malicious certificate fingerprint library, it is also possible to search in the detected certificate fingerprint library whether there is a target certificate fingerprint corresponding to the certificate to be detected. The certificate fingerprint in the above-mentioned detected certificate fingerprint library may be, but is not limited to, a certificate fingerprint that has been detected by the malicious certificate detection model of the embodiment of the present application, and may also be, but is not limited to, a certificate fingerprint that has been detected by other methods or a certificate fingerprint of a known detection result obtained from the network. At the same time, the detection results corresponding to the detected certificate fingerprint include malignant and benign.

[0080] It should be noted that, in the embodiment of the present application, S403 and S405 are not necessary steps, only one of them may be required, and the execution order may also be interchangeable.

[0081] S406: If the target certificate fingerprint exists in the detected certificate fingerprint library, the detection result corresponding to the target certificate fingerprint in the detected certificate fingerprint library is determined as the target detection result.

[0082] Specifically, the detected certificate fingerprint library includes malicious certificate fingerprints and benign certificate fingerprints. When the target certificate fingerprint exists in the detected certificate fingerprint library, it means that the certificate to be detected is a certificate with known attributes. At this time, there is no need to perform repeated detection. The detection result corresponding to the target certificate fingerprint in the detected certificate fingerprint library can be directly determined as the target detection result of the certificate to be detected. This avoids the problem of repeated detection using the malicious certificate detection model and improves the certificate detection efficiency.

[0083] Understandably, there are three situations for determining whether the target certificate fingerprint exists in the preset fingerprint library:

[0084] The first case is when the preset fingerprint library only includes the malicious certificate fingerprint library. After obtaining the target certificate fingerprint, S403 is executed to determine whether the target certificate fingerprint exists in the malicious certificate fingerprint library. If not, it means that the target certificate fingerprint belongs to a certificate fingerprint of unknown attributes, and S407 needs to be executed to detect the certificate to be detected using the malicious certificate detection model; if the target certificate fingerprint exists in the malicious certificate fingerprint library, it means that the target certificate fingerprint is a malicious certificate fingerprint, and S404 is executed to directly determine that the certificate to be detected corresponding to the target certificate fingerprint is a malicious certificate.

[0085] The second situation is when the preset fingerprint library only includes the detected certificate fingerprint library, after obtaining the target certificate fingerprint, execute S405 to determine whether the target certificate fingerprint exists in the detected certificate fingerprint library. If not, it means that the target certificate fingerprint belongs to a certificate fingerprint of unknown attributes, and it is necessary to execute S407 to detect the certificate to be detected using the malicious certificate detection model; if the target certificate fingerprint exists in the detected certificate fingerprint library, it means that the detection result of the certificate to be detected corresponding to the target certificate fingerprint already exists in the detected certificate fingerprint library, then execute S406, and the detection result corresponding to the target certificate fingerprint in the detected certificate fingerprint library can be directly used as the target detection result, without the need to perform subsequent steps of using the model to perform certificate detection.

[0086] The third case is to combine the first case with the second case. When the preset fingerprint library includes a malicious certificate fingerprint library and a detected certificate fingerprint library, the target certificate fingerprint is searched in the two fingerprint libraries respectively. If the query results are both empty, S407 is executed; if the target certificate fingerprint is found, the subsequent steps are executed according to the first case or the second case. In the embodiment of the present application, the query order of the malicious certificate fingerprint library and the detected certificate fingerprint library is not limited. That is, S404 and S406 can be executed simultaneously or one after another, and the embodiment of the present application does not limit this.

[0087] S407: Input the target feature metadata into the malicious certificate detection model and output the target detection result.

[0088] Specifically, S407 is consistent with S204 and will not be repeated here.

[0089] S408: Save the target certificate fingerprint and the target detection result in a detected certificate fingerprint library.

[0090] Specifically, after using the malicious certificate detection model to detect the certificate to be detected and obtaining the corresponding target detection result, the target detection result and the certificate fingerprint corresponding to the certificate to be detected can be associated and saved in the detected certificate fingerprint library, so that by saving the detected certificate to be detected and the corresponding detection result in the detected certificate fingerprint library, when a new certificate to be detected is detected next time, the target certificate fingerprint corresponding to the new certificate to be detected can be first searched in the detected certificate fingerprint library. If the same certificate fingerprint is found, the corresponding detection result is directly used as the target detection result of the new certificate to be detected. If the search result is empty, the subsequent model detection is performed. This can not only avoid repeated detection, improve detection efficiency, but also reduce the amount of calculation.

[0091] S409: When the certificate to be detected is a malicious certificate, an alarm message is issued, and the IP address corresponding to the certificate to be detected is blocked.

[0092] Specifically, when the certificate to be detected is determined to be a malicious certificate, an alarm message may be issued through, but not limited to, a terminal display screen or a speaker, and the IP address corresponding to the certificate to be detected is added to a blacklist, thereby ensuring the security of the system.

[0093] It can be understood that the above S408 and S409 can be executed successively or simultaneously, and the embodiment of the present application is not limited to this.

[0094] Please refer to the following Figure 5 , which exemplarily shows a schematic diagram of the structure of a certificate detection device provided in an embodiment of the present application. Figure 5 As shown, the certificate detection device 500 may include:

[0095] An acquisition module 510 is used to acquire a certificate to be tested;

[0096] The preprocessing module 520 is used to perform data preprocessing on the certificate to be detected to obtain target feature metadata; the target feature metadata includes the target certificate fingerprint corresponding to the certificate to be detected;

[0097] The judgment module 530 is used to judge whether the target certificate fingerprint exists in a preset fingerprint library; the preset fingerprint library includes certificate fingerprints with known detection results;

[0098] The detection module 540 is used to input the target feature metadata into the malicious certificate detection model if the target certificate fingerprint does not exist in the preset fingerprint library, and output the target detection result corresponding to the certificate to be detected; the malicious certificate detection model is trained based on a certificate sample data set with known detection results.

[0099] In some possible embodiments, the acquisition module 510 is specifically used to: receive traffic data to be detected; segment the traffic data to be detected to obtain a target session flow; and restore the certificate to be detected from the target session flow using a file restoration technology.

[0100] In some possible embodiments, the preprocessing module 520 is specifically used to: parse the certificate to be detected to obtain target certificate metadata; perform feature engineering on the target certificate metadata to obtain target feature metadata.

[0101] In some possible embodiments, the preset fingerprint library includes at least one of the following: a malicious certificate fingerprint library and a detected certificate fingerprint library; the malicious certificate fingerprint library includes certificate fingerprints corresponding to multiple malicious certificates; the detected certificate fingerprint library includes detected certificate fingerprints and detection results corresponding to the detected certificate fingerprints.

[0102] In some possible embodiments, the certificate detection device 500 further includes:

[0103] A first determination module, configured to determine that the certificate to be detected is a malicious certificate if the target certificate fingerprint exists in the malicious certificate fingerprint library; and / or

[0104] The second determination module is used to determine the detection result corresponding to the target certificate fingerprint in the detected certificate fingerprint library as the target detection result if the target certificate fingerprint exists in the detected certificate fingerprint library.

[0105] In some possible embodiments, the certificate detection device 500 further includes:

[0106] The storage module stores the target certificate fingerprint corresponding to the certificate to be detected and the target detection result in a detected certificate fingerprint library.

[0107] In some possible embodiments, the above-mentioned target non-fingerprint features include at least one of the following: certificate version, certificate signature hash algorithm, certificate public key length, number of certificate aliases, certificate validity period, certificate validity value, self-signed certificate, certificate domain name matching value, certificate verification status, certificate security level, low credibility of the certificate authority, entropy value of the CN field of the certificate user, entropy value of the CN field of the certificate issuer, and number of certificate extension items.

[0108] In some possible embodiments, the detection module 540 is specifically used to: input the target non-fingerprint feature into a malicious certificate detection model, and output a target detection result corresponding to the certificate to be detected.

[0109] In some possible embodiments, the certificate detection device 500 further includes:

[0110] The alarm module is used to issue an alarm message when the certificate to be detected is a malicious certificate, and block the IP address corresponding to the certificate to be detected.

[0111] It should be noted that the certificate detection device provided in the above embodiment only uses the division of the above-mentioned functional modules as an example when executing the certificate detection method. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the certificate detection device provided in the above embodiment belongs to the same concept as the certificate detection method embodiment. The implementation process thereof is detailed in the method embodiment and will not be repeated here. The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0112] Please refer to the following Figure 6 , which exemplarily shows a structural diagram of an electronic device provided in an embodiment of the present application. Figure 6 As shown, the electronic device 600 may include: at least one processor 610 , at least one network interface 640 , a user interface 630 , a memory 650 , and at least one communication bus 620 .

[0113] The communication bus 620 may be used to realize the connection and communication among the above-mentioned components.

[0114] The user interface 630 may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0115] The network interface 640 may optionally include a Bluetooth module, an NFC module, a Wi-Fi module, etc.

[0116] Among them, the processor 610 may include one or more processing cores. The processor 610 uses various interfaces and lines to connect various parts within the entire electronic device 600, and executes various functions and processes data of the electronic device 600 by running or executing instructions, programs, code sets or instruction sets stored in the memory 650, and calling data stored in the memory 650. Optionally, the processor 610 can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor 610 can integrate one or a combination of CPU, GPU, modem, etc. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to handle wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 610, but may be implemented separately through a chip.

[0117] The memory 650 may include a RAM or a ROM. Optionally, the memory 650 includes a non-transitory computer-readable medium. The memory 650 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 650 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a certificate acquisition function, a data preprocessing function, a malicious certificate detection function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 650 may optionally be at least one storage device located away from the aforementioned processor 610. As Figure 6 As shown, the memory 650 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a certificate detection application.

[0118] exist Figure 6 In the electronic device 600 shown, the user interface 630 is mainly used as an interface for data input. Specifically, the processor 610 can be used to call the certificate detection application stored in the memory 650, and perform the following operations: obtain the certificate to be detected; perform data preprocessing on the certificate to be detected to obtain the target feature metadata; the target feature metadata includes the target certificate fingerprint corresponding to the certificate to be detected; determine whether the target certificate fingerprint exists in the preset fingerprint library; the preset fingerprint library includes the certificate fingerprint of the known detection result; if the target certificate fingerprint does not exist in the preset fingerprint library, input the target feature metadata into the malicious certificate detection model, and output the target detection result corresponding to the certificate to be detected; the malicious certificate detection model is trained based on the certificate sample data set with the known detection result.

[0119] In some possible embodiments, when the processor 610 executes the acquisition of the certificate to be detected, it is specifically used to execute: receiving the traffic data to be detected; segmenting the traffic data to be detected to obtain the target session flow; and restoring the certificate to be detected from the target session flow using the file restoration technology.

[0120] In some possible embodiments, when the processor 610 performs data preprocessing on the certificate to be detected and obtains target feature metadata, it is specifically used to execute: parsing the certificate to be detected to obtain target certificate metadata; performing feature engineering on the target certificate metadata to obtain target feature metadata.

[0121] In some possible embodiments, the preset fingerprint library includes at least one of the following: a malicious certificate fingerprint library and a detected certificate fingerprint library; the malicious certificate fingerprint library includes certificate fingerprints corresponding to multiple malicious certificates; the detected certificate fingerprint library includes detected certificate fingerprints and detection results corresponding to the detected certificate fingerprints.

[0122] In some possible embodiments, after determining whether the target certificate fingerprint exists in a preset fingerprint library, the processor 610 is further configured to execute:

[0123] If the target certificate fingerprint exists in the malicious certificate fingerprint library, the certificate to be detected is determined to be a malicious certificate; and / or, if the target certificate fingerprint exists in the detected certificate fingerprint library, the detection result corresponding to the target certificate fingerprint in the detected certificate fingerprint library is determined as the target detection result.

[0124] In some possible embodiments, after the processor 610 inputs the target feature metadata into a malicious certificate detection model and outputs the target detection result corresponding to the certificate to be detected, it is further configured to execute:

[0125] The target certificate fingerprint corresponding to the certificate to be detected and the target detection result are stored in the detected certificate fingerprint library.

[0126] In some possible embodiments, the target feature metadata also includes target non-fingerprint features; the target non-fingerprint features include at least one of the following: certificate version, certificate signature hash algorithm, certificate public key length, number of certificate aliases, certificate validity period, certificate validity value, self-signed certificate, certificate domain name matching value, certificate verification status, certificate security level, low credibility of the certificate authority, entropy value of the CN field of the certificate user, entropy value of the CN field of the certificate issuer, and number of certificate extension items.

[0127] In some possible embodiments, when the processor 610 inputs the target feature metadata into a malicious certificate detection model and outputs the target detection result corresponding to the certificate to be detected, it is specifically used to execute: input the target non-fingerprint feature into a malicious certificate detection model and output the target detection result corresponding to the certificate to be detected.

[0128] In some possible embodiments, the processor 610 is further configured to execute: in the case where the certificate to be detected is a malicious certificate, issue an alarm message and block the IP address corresponding to the certificate to be detected.

[0129] The embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer or a processor, the computer or the processor executes the above-mentioned Figure 2or Figure 3 or Figure 4 One or more steps in the illustrated embodiment. If the components of the electronic device described above are implemented in the form of software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium described above.

[0130] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above-mentioned computer program product includes one or more computer instructions. When the above-mentioned computer program instructions are loaded and executed on a computer, the above-mentioned process or function according to the embodiment of the present application is generated in whole or in part. The above-mentioned computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The above-mentioned computer instructions can be stored in a computer-readable storage medium or transmitted by the above-mentioned computer-readable storage medium. The above-mentioned computer instructions can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (such as coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The above-mentioned computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, a data center, etc. that contains one or more available media integrated. The above-mentioned available media can be magnetic media (for example, floppy disks, hard disks, tapes), optical media (for example, digital versatile discs (DVD)), or semiconductor media (for example, solid state disks (SSD)), etc.

[0131] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0132] The above embodiments are merely descriptions of preferred embodiments of the present application and are not intended to limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements made to the technical solutions of the present application by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present application.

Claims

1. A certificate detection method, characterized in that: The method comprises: Obtain the certificate to be tested; Performing data preprocessing on the certificate to be detected to obtain target feature metadata; the target feature metadata includes a target certificate fingerprint corresponding to the certificate to be detected; Determine whether the target certificate fingerprint exists in a preset fingerprint library; the preset fingerprint library includes certificate fingerprints with known detection results; If the target certificate fingerprint does not exist in the preset fingerprint library, the target feature metadata is input into a malicious certificate detection model, and the target detection result corresponding to the certificate to be detected is output; the malicious certificate detection model is trained based on a certificate sample data set with known detection results.

2. The method according to claim 1, characterized in that The step of obtaining the certificate to be tested includes: Receiving traffic data to be detected; Segmenting the traffic data to be detected to obtain a target session flow; The certificate to be tested is restored from the target session stream using a file restoration technology.

3. The method according to claim 1, characterized in that The preset fingerprint library includes at least one of the following: a malicious certificate fingerprint library and a detected certificate fingerprint library; the malicious certificate fingerprint library includes certificate fingerprints corresponding to multiple malicious certificates; The detected certificate fingerprint library includes detected certificate fingerprints and detection results corresponding to the detected certificate fingerprints.

4. The method according to claim 3, characterized in that After determining whether the target certificate fingerprint exists in a preset fingerprint library, the method further includes: If the target certificate fingerprint exists in the malicious certificate fingerprint library, determining that the certificate to be detected is a malicious certificate; and / or If the target certificate fingerprint exists in the detected certificate fingerprint library, the detection result corresponding to the target certificate fingerprint in the detected certificate fingerprint library is determined as the target detection result.

5. The method according to claim 1, characterized in that After inputting the target feature metadata into a malicious certificate detection model and outputting a target detection result corresponding to the certificate to be detected, the method further includes: The target certificate fingerprint corresponding to the certificate to be detected and the target detection result are stored in a detected certificate fingerprint library.

6. The method according to any one of claims 1 to 5, characterized in that: The target feature metadata also includes target non-fingerprint features; the target non-fingerprint features include at least one of the following: certificate version, certificate signature hash algorithm, certificate public key length, number of certificate aliases, certificate validity period, certificate validity value, self-signed certificate, certificate domain name matching value, certificate verification status, certificate security level, low credibility of the certificate authority, certificate user CN field entropy value, certificate issuer CN field entropy value, and number of certificate extension items.

7. The method according to claim 6, characterized in that The step of inputting the target feature metadata into a malicious certificate detection model and outputting a target detection result corresponding to the certificate to be detected includes: The target non-fingerprint feature is input into a malicious certificate detection model, and a target detection result corresponding to the certificate to be detected is output.

8. A certificate detection device, characterized in that: The device comprises: An acquisition module is used to obtain the certificate to be tested; A preprocessing module, used for performing data preprocessing on the certificate to be detected to obtain target feature metadata; the target feature metadata includes a target certificate fingerprint corresponding to the certificate to be detected; A judgment module, used to judge whether the target certificate fingerprint exists in a preset fingerprint library; the preset fingerprint library includes certificate fingerprints with known detection results; The detection module is used to input the target feature metadata into a malicious certificate detection model if the target certificate fingerprint does not exist in the preset fingerprint library, and output the target detection result corresponding to the certificate to be detected; the malicious certificate detection model is trained based on a certificate sample data set with known detection results.

9. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores an executable program code, and the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and executing the method steps according to any one of claims 1-7.

Images