Abnormal digital certificate automatic revocation method and device based on CT log, equipment, storage medium and program product

Abstract

This invention relates to the field of network security technology and discloses a method, apparatus, electronic device, readable storage medium, and program product for automatic revocation of abnormal digital certificates based on CT logs. It addresses the technical problem in existing technologies where abnormal digital certificates cannot be detected in a timely manner, leading to high security risks when accessing websites or authenticating identity. The method includes: obtaining CT logs from multiple CT log servers and filtering out newly issued certificate records related to the target domain name from the obtained CT logs; performing multi-dimensional anomaly detection on the newly issued certificate records based on a fusion detection algorithm, and combining the anomaly detection results from multiple dimensions to determine whether there are any abnormal certificate issuance records; when an abnormal certificate issuance record is detected, submitting a certificate revocation request to the CA corresponding to the abnormal certificate issuance record to revoke the digital certificate corresponding to the abnormal certificate issuance record. This method can promptly identify and revoke abnormal digital certificates.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, electronic device, computer storage medium, and computer program product for automatic revocation of abnormal digital certificates based on CT logs. Background Technology

[0002] In today's internet environment, digital certificates are widely used for website encryption and authentication, serving as a crucial foundation for network security. To prevent the forgery or misuse of digital certificates, the industry has introduced Certificate Transparency Logs (CT Logs). CT Logs record all issued certificates, accessible to anyone, aiming to increase the transparency of certificate issuance and help identify suspicious certificates issued without authorization. However, current practical applications often encounter several problems, such as: the need for manual review, analysis, and handling of abnormal certificates; insufficient automation in the certificate revocation process, leading to delays; lack of alerting mechanisms for simply recording certificates, preventing timely risk detection by operations and maintenance personnel; and a lack of automated coordination between different stages, resulting in low overall response efficiency.

[0003] Therefore, there is an urgent need for a more automated and efficient method that can utilize CT logs to automatically revoke certificates and issue timely warnings upon detecting abnormal certificates, helping the system respond to potential security issues more quickly and improving overall response speed and security protection capabilities. Summary of the Invention

[0004] The main objective of this invention is to solve the technical problem in the prior art that it is impossible to automatically and in real time detect the existence of unauthorized or abnormal certificate issuance records, which leads to the inability to detect abnormal digital certificates in a timely manner, resulting in high security risks when accessing websites or verifying identity.

[0005] The first aspect of this invention provides a method for automatically revoking abnormal digital certificates based on CT logs, comprising:

[0006] Obtain CT logs from multiple CT log servers, and filter out newly issued certificate records related to the target domain name from the obtained CT logs;

[0007] The newly issued certificate records are subjected to multi-dimensional anomaly detection based on the fusion detection algorithm. The results of the anomaly detection in multiple dimensions are combined to determine whether there are abnormal certificate issuance records.

[0008] When an abnormal certificate issuance record is detected, a certificate revocation request is submitted to the CA corresponding to the abnormal certificate issuance record to revoke the digital certificate corresponding to the abnormal certificate issuance record.

[0009] Optionally, in a first implementation of the first aspect of the present invention, the step of obtaining CT logs from multiple CT log servers and filtering out newly issued certificate records related to the target domain name from the obtained CT logs includes:

[0010] CT log information from multiple log servers is obtained by continuously subscribing to the CT real-time stream mechanism;

[0011] Determine whether the newly issued certificate information in the CT log information is a certificate information that has already undergone anomaly detection;

[0012] If the certificate information has not undergone anomaly detection, then the certificate information is subjected to integrity verification to determine whether it has been tampered with.

[0013] If the certificate information has not been tampered with, the preset domain name filtering requirements are received, and new certificate issuance records related to the target domain name are obtained based on the domain name filtering requirements.

[0014] Optionally, in a second implementation of the first aspect of the present invention, the step of performing multi-dimensional anomaly detection on the newly issued certificate record based on the fusion detection algorithm, and determining whether the record contains an anomaly based on the anomaly detection results of multiple dimensions, includes:

[0015] Multiple sub-models of the fusion detection model are invoked to perform multi-dimensional parallel detection, and anomaly probability score, reconstruction error score, Boolean detection score and confidence of each score are obtained respectively. The sub-models include an isolated forest model, a temporal autoencoder model and a rule engine model.

[0016] The evaluation results are fused based on the anomaly probability score, reconstruction error score, Boolean detection score, and the confidence level of each score to obtain the anomaly risk assessment result and the confidence level of the assessment result;

[0017] Based on the aforementioned anomaly risk assessment results and the confidence level of the assessment results, it is determined whether the certificate issuance records contain any anomalies.

[0018] Optionally, in a third implementation of the first aspect of the present invention, the fusion of evaluation results based on the anomaly probability score, reconstruction error score, Boolean detection score, and the confidence level of each score includes:

[0019] Obtain the historical accuracy information of each sub-model in the fusion detection model, the current anomaly assessment scenario features, and model-related information;

[0020] The strategy adjustment algorithm is invoked to adjust the fusion weights based on the historical accuracy information, the characteristics of the anomaly evaluation scenario, and the relevant information of each of the sub-models;

[0021] Based on the fusion weights, the evaluation results of the anomaly probability score, reconstruction error score, Boolean detection score, and the confidence level of each score are fused.

[0022] Optionally, in a fourth implementation of the first aspect of the present invention, after revoking the digital certificate corresponding to the abnormal certificate issuance record, the method further includes:

[0023] Based on the certificate revocation data within a preset time period, the false alarm rate, false alarm rate, and revocation success rate are statistically evaluated, and normalization is performed to obtain the state vector of the revocation behavior.

[0024] An adjustment strategy is generated based on the state vector of the revocation behavior, and the configuration parameters of the fusion detection model are modified based on the adjustment strategy.

[0025] Optionally, in a fifth implementation of the first aspect of the present invention, after revoking the digital certificate corresponding to the abnormal certificate issuance record, the method further includes:

[0026] The certificate details, abnormal risk assessment results, and adjustment strategies of the digital certificate to be revoked are packaged to obtain risk warning information;

[0027] The risk warning information is pushed to a preset risk warning platform and displayed and alerted in real time.

[0028] A second aspect of the present invention provides an automatic revocation device for abnormal digital certificates based on CT logs, comprising:

[0029] The certificate record acquisition module is used to obtain CT logs from multiple CT log servers and filter out newly issued certificate records related to the target domain name from the obtained CT logs.

[0030] An anomaly detection module is used to perform multi-dimensional anomaly detection on the newly added certificate issuance records based on a fusion detection model, and to determine whether there are any abnormal certificate issuance records by combining the anomaly detection results from multiple dimensions.

[0031] The certificate revocation module is used to submit a certificate revocation request to the CA corresponding to the abnormal certificate issuance record when an abnormal certificate issuance record is detected, and revoke the digital certificate corresponding to the abnormal certificate issuance record.

[0032] A third aspect of the present invention provides an automatic revocation device for abnormal digital certificates based on CT logs, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the automatic revocation device for abnormal digital certificates based on CT logs to perform the steps of the above-described automatic revocation method for abnormal digital certificates based on CT logs.

[0033] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the steps of the above-described method for automatic revocation of abnormal digital certificates based on CT logs.

[0034] A fifth aspect of the present invention provides a computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the above-described method for automatic revocation of abnormal digital certificates based on CT logs.

[0035] The technical solution provided by this invention obtains CT logs from multiple CT log servers and filters out newly issued certificate records related to the target domain name from the obtained CT logs. Based on a fusion detection model, multi-dimensional anomaly detection is performed on the newly issued certificate records, and the results of the multi-dimensional anomaly detection are combined to determine whether there are any abnormal certificate issuance records. When an abnormal certificate issuance record is detected, a certificate revocation request is submitted to the CA corresponding to the abnormal certificate issuance record to revoke the digital certificate corresponding to the abnormal certificate issuance record. This method can automatically and in real-time detect the existence of unauthorized or abnormal certificate issuance records, promptly detect and revoke abnormal digital certificates, improve the security of website access or identity verification, and increase the efficiency of security detection.

[0036] Meanwhile, the device, electronic device, computer-readable storage medium, and computer program product provided by this invention also solve the corresponding technical problems. Attached Figure Description

[0037] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0038] Figure 1 This is a flowchart illustrating the first embodiment of the automatic revocation method for abnormal digital certificates based on CT logs in this invention.

[0039] Figure 2 This is a flowchart illustrating the second embodiment of the automatic revocation method for abnormal digital certificates based on CT logs in this invention.

[0040] Figure 3 This is a schematic diagram of an embodiment of the automatic revocation device for abnormal digital certificates based on CT logs in this invention.

[0041] Figure 4 This is a schematic diagram of an embodiment of the automatic revocation device for abnormal digital certificates based on CT logs in this invention.

[0042] Figure 5 This is a schematic diagram illustrating the principle of a computer-readable medium according to an embodiment of the present invention. Detailed Implementation

[0043] Exemplary embodiments of the invention will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limiting the invention to the embodiments set forth herein. Rather, these exemplary embodiments are provided to make the invention more comprehensive and complete, and to facilitate a full communication of the inventive concept to those skilled in the art. The same reference numerals in the drawings denote the same or similar elements, components, or parts, and therefore repeated descriptions of them will be omitted.

[0044] Subject to the technical concept of this invention, the features, structures, characteristics or other details described in a particular embodiment may be combined in one or more other embodiments in a suitable manner.

[0045] In the description of specific embodiments, the features, structures, characteristics, or other details described in this invention are intended to enable those skilled in the art to fully understand the embodiments. However, it is not excluded that those skilled in the art can practice the technical solutions of this invention without one or more of the specific features, structures, characteristics, or other details.

[0046] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0047] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0048] The terms “and / or” or “and / or” include all combinations of any one or more of the listed items.

[0049] Please see Figure 1 The first embodiment of the automatic revocation method for abnormal digital certificates based on CT logs in this invention includes:

[0050] S101. Obtain CT logs from multiple CT log servers, and filter out newly issued certificate records related to the target domain name from the obtained CT logs;

[0051] It is understood that the executing entity of this invention can be an automatic revocation device for abnormal digital certificates based on CT logs, or it can be a terminal or a server; the specific implementation is not limited here. This embodiment of the invention will be described using a server as an example.

[0052] In this embodiment, the CT log refers to the Certificate Transparency log, which is a network security mechanism designed to enhance the security and transparency of digital certificates such as SSL or TLS by publicly recording and auditing the issuance process of digital certificates.

[0053] Specifically, when retrieving CT log information from multiple CT log sources, a WebSocket stream can be established using tools like CertStream that can continuously subscribe to real-time CT streams, connecting to multiple CT log servers. This allows for real-time and continuous reception of certificate update data from multiple CT log servers. Upon receiving the certificate update data, it is parsed and certificate information is extracted. This certificate information includes: certificate serial number, domain name, issuer, certificate validity period, and certificate issuance time. Based on preset filtering rules, newly issued certificates of interest can be selected according to different information items.

[0054] In one specific implementation, when the focus is on several domain names, the system can filter based on the domain name fields contained in the certificate information, using preset target domain name information, to obtain newly issued certificate records related to the target domain names. Furthermore, the filtered newly issued certificate records related to the target domain names can be saved in a table format.

[0055] S102. Perform multi-dimensional anomaly detection on newly added certificate issuance records based on the fusion detection algorithm, and combine the anomaly detection results of multiple dimensions to determine whether there are abnormal certificate issuance records.

[0056] The fusion detection algorithm described in this embodiment is a scheme for multi-dimensional anomaly detection of newly issued certificate records based on a fusion detection model. This fusion detection model is constructed by fusing multiple sub-models. This scheme can call multiple sub-models to perform anomaly assessments on newly issued certificate records in different dimensions, outputting multiple anomaly assessment scores. Then, these scores are fused to obtain the final anomaly risk assessment result. Subsequently, based on the anomaly risk assessment result, it is determined whether the currently newly issued certificate records contain any abnormal certificate issuance records. Specifically, an anomaly assessment threshold can be preset. If the anomaly risk assessment result exceeds the threshold, the certificate issuance record corresponding to that result is considered to have an anomaly; if the result does not exceed the threshold, the certificate issuance record is considered to have no anomaly.

[0057] In one specific implementation, the sub-models can be isolated forest models, temporal autoencoders, and rule engines; and a policy adjustment algorithm is invoked to achieve a fusion decision based on the evaluation scores output by each sub-model. In this embodiment, the policy adjustment algorithm can adaptively and dynamically adjust the fusion weights of the evaluation scores output by each sub-model based on information such as historical accuracy and scene features. This policy adjustment algorithm can be implemented based on a deep learning intelligent agent, adjusting the weights of the results output by each sub-model during fusion to improve overall detection accuracy and detection generalization ability.

[0058] S103. When an abnormal certificate issuance record is detected, submit a certificate revocation request to the CA (Certificate Authority) corresponding to the abnormal certificate issuance record to revoke the digital certificate corresponding to the abnormal certificate issuance record.

[0059] Based on the detection steps in S102, when an abnormal certificate issuance record is detected, the abnormal certificate issuance record is obtained, the CA that issued the certificate is found according to the content recorded in the certificate issuance record, and a certificate revocation request is submitted to it to revoke the corresponding digital certificate.

[0060] The method in this embodiment can automatically and in real time detect whether there are unauthorized or abnormal certificate issuance records, and can detect and revoke abnormal digital certificates in a timely manner, thereby improving the security of accessing websites or authenticating identity and increasing the efficiency of security detection.

[0061] Please see Figure 2 The second embodiment of the automatic revocation method for abnormal digital certificates based on CT logs in this invention includes:

[0062] S201. Obtain CT logs from multiple CT log servers, and filter out newly issued certificate records related to the target domain name from the obtained CT logs;

[0063] In this embodiment, the CT log refers to the Certificate Transparency log, which is a network security mechanism designed to enhance the security and transparency of digital certificates such as SSL or TLS by publicly recording and auditing the issuance process of digital certificates.

[0064] In one specific implementation, when obtaining CT log information from multiple CT log sources, the CertStream tool can be used to connect to the WebSocket streams of multiple CT log servers. By continuously subscribing to the CT real-time stream mechanism, CT log information from multiple log servers can be obtained, thereby continuously receiving certificate update data in real time from multiple CT log servers. Upon receiving the certificate update data, the data is parsed and certificate information is extracted. This certificate information includes: certificate serial number, domain name, issuer, certificate validity period, and certificate issuance time.

[0065] After obtaining the certificate information, the process also includes calling a Bloom filter to check each certificate entry. The Bloom filter can quickly determine whether a certificate has undergone anomaly detection. If the certificate information has already undergone anomaly detection, it is skipped; if the certificate information has not undergone anomaly detection, subsequent processing continues.

[0066] In another specific implementation, a custom parallel computing framework, an asynchronous event-driven model (Event Loop with Non-blocking I / O), and a customized memory pool management mechanism can be used to achieve log stream parsing and message decoupling processing at a rate of tens of thousands of records per second. Combined with a Bloom filter and an incremental Merkle tree cache, rapid deduplication and tree structure integrity verification can be achieved. Specifically, when CT logs use a Merkle tree structure to ensure log integrity, this embodiment uses an incremental Merkle tree cache to verify the tree structure of the certificate data. The server in this embodiment maintains an incremental Merkle tree cache to verify the tree structure of received certificate update data, ensuring that the data has not been tampered with during transmission. If the certificate information has not been tampered with, a preset domain name filtering requirement is received, and newly issued certificate records related to the target domain name are obtained based on the domain name filtering requirement.

[0067] After obtaining the certificate information, the process also includes acquiring pre-defined matching requirements and rules, searching for and tracking the certificate information related to the target domains of the companies being monitored in the received certificate information, and creating a list of newly issued certificate records based on the filtered certificate information.

[0068] In a preferred embodiment, after receiving certificate update data, each certificate update event is encapsulated into a message and placed in a message queue for decoupling, so as to facilitate subsequent parallel processing.

[0069] S202. Call multiple sub-models of the fusion detection model to perform multi-dimensional parallel detection, and obtain the anomaly probability score, reconstruction error score, Boolean detection score and the confidence level of each score respectively;

[0070] The fusion detection model described in this embodiment is obtained by fusing sub-models such as the Isolation Forest model, the Temporal Autoencoder, and the Rule Engine. These models can be called for parallel detection, thereby performing anomaly detection and scoring from multiple dimensions and data processing methods based on multiple sub-models. The scoring results of each sub-model are obtained, and finally, the scoring results are fused to obtain the final anomaly detection value. Based on the obtained anomaly detection value, it is determined whether the list of newly issued certificate records contains abnormal certificate issuance records.

[0071] Specifically, in this step, the isolated forest model, the temporal autoencoder, and the rule engine are first invoked to perform parallel detection, obtaining anomaly probability scores, reconstruction error scores, and Boolean detection scores, as well as the confidence levels of each score. The anomaly probability scores, reconstruction error scores, Boolean detection scores, and the confidence levels of each score are then fused to output an anomaly score. After spatial unification of the judgment results from multiple judgment models, they are fused based on a fusion strategy to obtain anomaly voting results and confidence levels. Based on the anomaly voting results and confidence levels, it is determined whether there are any abnormal certificate issuance records.

[0072] S203. The evaluation results are fused based on the anomaly probability score, reconstruction error score, Boolean detection score, and the confidence level of each score to obtain the anomaly risk assessment result and the confidence level of the assessment result;

[0073] S204. Determine whether the certificate issuance records contain abnormalities based on the results of the abnormal risk assessment and the confidence level of the assessment results;

[0074] The process involves: acquiring historical accuracy information of each sub-model in the fusion detection model, current anomaly assessment scenario characteristics, and model-related information; invoking a strategy adjustment algorithm to adjust the fusion weights based on historical accuracy information, anomaly assessment scenario characteristics, and model-related information; and fusing the evaluation results based on the adjusted fusion weights using anomaly probability scores, reconstruction error scores, Boolean detection scores, and the confidence levels of each score. Subsequently, based on the anomaly risk assessment results, it is determined whether the currently newly issued certificate records contain any anomaly-related certificate issuance records. Specifically, an anomaly assessment threshold can be pre-set. If the anomaly risk assessment result exceeds the threshold, the certificate issuance record corresponding to that result is considered anomaly-free; otherwise, it is considered non-anomaly-free.

[0075] S205. When an abnormal certificate issuance record is detected, submit a certificate revocation request to the CA (Certificate Authority) corresponding to the abnormal certificate issuance record to revoke the digital certificate corresponding to the abnormal certificate issuance record.

[0076] In this embodiment, when an abnormal certificate issuance record is detected, the system automatically calls the standardized revocation interface to achieve highly reliable certificate revocation.

[0077] Specifically, a unified abstract interface (such as Support CA-SDK and ACME v2) can be used to call the revocation API (Application Programming Interface). This revocation API is compatible with multiple CAs, and when an anomaly score exceeds a threshold or the rule engine directly determines it to be high-risk, the system immediately initiates a revocation request. This approach integrates retry mechanisms and exception handling to ensure the success rate of revocation requests. In conjunction with the adaptive strategy module, the revocation result serves as feedback input to the reward function.

[0078] S206. Based on the certificate revocation data information within a preset time period, statistically evaluate the false alarm rate, false alarm rate, and revocation success rate, and perform normalization to obtain the state vector of the revocation behavior.

[0079] S207. Generate an adjustment strategy based on the state vector of the revocation behavior, and modify the configuration parameters of the fusion detection model based on the adjustment strategy;

[0080] In this embodiment, an intelligent agent built based on deep reinforcement learning is also included to optimize the fusion strategy.

[0081] In one specific implementation, this embodiment may include collecting manual review results through a human-machine collaborative annotation platform, and periodically retraining the model using an active learning strategy to maintain the system's adaptability to new attack patterns. The annotation platform provides a graphical interface for operations and maintenance personnel to label false positives / false negatives, forming an annotated dataset. Based on the annotated data, an active learning strategy is used to select high-value samples, and the DRL Agent (Deep Learning Intelligent Agent) and detection models (such as Isolation Forest or Autoencoder) are periodically retrained. Through a closed-loop optimization method, feedback data is directly embedded into the DRL training process to dynamically adjust model weights and thresholds, achieving continuous self-evolution.

[0082] In a preferred embodiment, this step enhances the model's collaborative effectiveness at both the feature-level collaboration and decision-level voting levels:

[0083] (1) Feature-level collaboration: The intermediate features of isolated forest and temporal autoencoder are embedded into the same feature space, and a multi-head attention mechanism is applied for weighted fusion to automatically learn the optimal combination weights of each model under different abnormal scenarios.

[0084] (2) Decision-level voting: For the abnormal scores or Boolean results output by each sub-model (Isolation Forest, Temporal Autoencoder, Rule Engine), a policy adjustment algorithm is used to achieve fusion decision. The policy adjustment algorithm can be implemented based on a deep learning intelligent agent. Specifically, the policy adjustment algorithm calculates the importance information of each model in the current scene based on the historical accuracy of each model, the characteristics of the current detection scene, and the correlation between models through a multi-head attention mechanism. The voting weights are dynamically adjusted according to the importance information to form a gating mechanism with a memory factor. It not only considers the current input but also combines the model's past performance in similar scenes for dynamic hierarchical weighting. At the same time, this mechanism is interpretable and can output the confidence evaluation and participation weight of each model for subsequent feedback learning. This fusion strategy differs from the traditional simple superposition method and provides adaptive joint judgment logic with context awareness and policy awareness, improving the overall detection accuracy and generalization ability.

[0085] This embodiment also includes a function for real-time optimization of multiple parallel models in the fusion detection model. Based on the Deep Reinforcement Learning (DRL) framework, it optimizes the thresholds and rules of the anomaly detection module in real time. Through online and offline hybrid training, it achieves adaptive adjustment of the strategy, ensuring detection accuracy and stability. Specifically, a policy intelligent agent is pre-constructed, and a high-potential region is pre-selected in the local hyperparameter space using a Bayesian optimization algorithm. Then, the deep learning intelligent agent (DRL Agent) performs continuous action search within this region, ensuring sampling efficiency and convergence speed. Performance metrics of the automatic revocation method in this embodiment (such as false positive rate, false negative rate, SLA latency, and revocation success rate) are collected in real time, and the state vector is normalized and calculated. The parameters of the fusion model are adjusted based on this state vector. Furthermore, the policy intelligent agent constructed in this embodiment utilizes a feedback learning method that not only adjusts based on overall false positive and false negative rates, but also breaks down the adjustments to "model + rule" combinations, automatically adjusting the corresponding fusion weights and thresholds for different combinations.

[0086] To illustrate with a specific example, the strategy optimization process in this embodiment includes:

[0087] (1) Status acquisition: The environmental evaluator aggregates the most recent N detection results and feedback every minute, extracts performance indicators such as false alarm rate, false negative rate, SLA delay and revocation success rate, and normalizes them into a state vector. ;

[0088] (2) Action Generation: In this embodiment, the intelligent agent is based on a deep reinforcement learning (DRL) framework and adopts an Actor-Critic dual-network architecture. The Actor generates adjustment instructions, and the Critic evaluates the policy quality. In the action generation step, the Actor network receives... Output action (e.g., adjusting the isolated forest threshold, updating rule engine parameters);

[0089] (3) Strategy execution: System application actions In real time, the parameters and other configurations of the fusion detection model can be modified.

[0090] (4) Reward feedback: Calculate the reward in the next time window. ;in The calculation expression is:

[0091]

[0092] and the reward Send it to the Critic network to update the value estimate; among which... , and All are weighting coefficients;

[0093] (5) Online training: Micro-batch gradient updates are performed using experience replay and priority sampling to gradually optimize the Actor and Critic networks;

[0094] (6) Offline fine-tuning: Daily scheduled training is performed on the best strategies in the strategy library to generate new strategies and push them to the intelligent agent.

[0095] In one specific implementation, when using a deep reinforcement learning framework to optimize strategies in real time, in order to prevent the new strategy from causing a surge in false alarms, the present invention also designs a "canary release" mechanism: the new strategy is only tested on a portion of mirror nodes (10% of traffic), and once it passes the acceptance of latency, accuracy and business metrics, it is then pushed to the full network.

[0096] S208. The certificate details of the digital certificate to be revoked, the abnormal risk assessment results, and the adjustment strategy are encapsulated to obtain risk warning information;

[0097] S209. Push risk warning information to the preset risk warning platform and display and alert in real time.

[0098] This embodiment, based on a Kafka / Event Mesh distribution structure, encapsulates the certificate details, anomaly risk assessment results, and adjustment strategies of the revoked digital certificates corresponding to detected abnormal certificate records, resulting in risk warning information containing certificate fingerprints, model scores, and DRL action information. This warning information is then pushed in real-time to a preset risk warning platform via email, SMS (Short Messaging Service), or an operations and maintenance platform webhook, enabling real-time alerts. Furthermore, this embodiment also supports real-time display of the Sentry risk control dashboard for relevant personnel to view and confirm.

[0099] This invention constructs a fully automated and intelligent certificate security management system. Its core innovation lies in the deep integration of DRL (Depth Reduction Level) with multi-model detection, introducing deep reinforcement learning into the anomaly detection strategy of CT (Certificate Revocation) logs. This breaks through the simple threshold retraining mode, achieving real-time self-optimization of detection rules. It realizes real-time self-optimization of the strategy and end-to-end closed-loop response, significantly improving the efficiency of certificate revocation and the accuracy of risk warnings. Furthermore, by combining Bloom filtering and Merkle caching, this invention can acquire CT log information in real-time and rapidly, accelerating the response speed. Combined with the continuous online learning function of an intelligent agent based on deep learning algorithms, it can quickly capture and disable new scenarios of abused or phishing certificates from human feedback.

[0100] The above describes the method for automatic revocation of abnormal digital certificates based on CT logs in embodiments of the present invention. The following describes the device for automatic revocation of abnormal digital certificates based on CT logs in embodiments of the present invention. Please refer to [link to relevant documentation]. Figure 3 One embodiment of the automatic revocation device for abnormal digital certificates based on CT logs in this invention includes:

[0101] The certificate record acquisition module 301 is used to acquire CT logs from multiple CT log servers and filter out newly issued certificate records related to the target domain name from the acquired CT logs.

[0102] The anomaly detection module 302 is used to perform multi-dimensional anomaly detection on the newly added certificate issuance record based on the fusion detection model, and to determine whether there is an abnormal certificate issuance record by combining the anomaly detection results of multiple dimensions.

[0103] The certificate revocation module 303 is used to submit a certificate revocation request to the CA corresponding to the abnormal certificate issuance record when an abnormal certificate issuance record is detected, and revoke the digital certificate corresponding to the abnormal certificate issuance record.

[0104] The device in this embodiment can automatically and in real time detect whether there are unauthorized or abnormal certificate issuance records, and can detect and revoke abnormal digital certificates in a timely manner, thereby improving the security of accessing websites or authenticating identity and increasing the efficiency of security detection.

[0105] In another embodiment of this application, the certificate record acquisition module 301 is specifically used for:

[0106] CT log information from multiple log servers is obtained by continuously subscribing to the CT real-time stream mechanism;

[0107] Determine whether the newly issued certificate information in the CT log information is a certificate information that has already undergone anomaly detection;

[0108] If the certificate information has not undergone anomaly detection, then the certificate information is subjected to integrity verification to determine whether it has been tampered with.

[0109] If the certificate information has not been tampered with, the preset domain name filtering requirements are received, and new certificate issuance records related to the target domain name are obtained based on the domain name filtering requirements.

[0110] In another embodiment of this application, the anomaly detection module 302 is specifically used for:

[0111] Multiple sub-models of the fusion detection model are invoked to perform multi-dimensional parallel detection, and anomaly probability score, reconstruction error score, Boolean detection score and confidence of each score are obtained respectively. The sub-models include an isolated forest model, a temporal autoencoder model and a rule engine model.

[0112] The evaluation results are fused based on the anomaly probability score, reconstruction error score, Boolean detection score, and the confidence level of each score to obtain the anomaly risk assessment result and the confidence level of the assessment result;

[0113] Based on the aforementioned anomaly risk assessment results and the confidence level of the assessment results, it is determined whether the certificate issuance records contain any anomalies.

[0114] In another embodiment of this application, the fusion of evaluation results based on the anomaly probability score, reconstruction error score, Boolean detection score, and the confidence level of each score includes:

[0115] Obtain the historical accuracy information of each sub-model in the fusion detection model, the current anomaly assessment scenario features, and model-related information;

[0116] The strategy adjustment algorithm is invoked to adjust the fusion weights based on the historical accuracy information, the characteristics of the anomaly evaluation scenario, and the relevant information of each of the sub-models;

[0117] Based on the fusion weights, the evaluation results of the anomaly probability score, reconstruction error score, Boolean detection score, and the confidence level of each score are fused.

[0118] In another embodiment of this application, the automatic revocation device for abnormal digital certificates based on CT logs further includes a fusion adjustment module, which is specifically used for:

[0119] Based on the certificate revocation data within a preset time period, the false alarm rate, false alarm rate, and revocation success rate are statistically evaluated, and normalization is performed to obtain the state vector of the revocation behavior.

[0120] An adjustment strategy is generated based on the state vector of the revocation behavior, and the configuration parameters of the fusion detection model are modified based on the adjustment strategy.

[0121] In another embodiment of this application, after revoking the digital certificate corresponding to the abnormal certificate issuance record, the method further includes:

[0122] The certificate details, abnormal risk assessment results, and adjustment strategies of the digital certificate to be revoked are packaged to obtain risk warning information;

[0123] The risk warning information is pushed to a preset risk warning platform and displayed and alerted in real time.

[0124] The device in this embodiment can automatically and in real time detect whether there are unauthorized or abnormal certificate issuance records, and can detect and revoke abnormal digital certificates in a timely manner, thereby improving the security of accessing websites or authenticating identity and increasing the efficiency of security detection.

[0125] Based on the same inventive concept, this invention also provides an automatic revocation system for abnormal digital certificates based on CT logs. The corresponding description of this system can be found in the above embodiments, and will not be repeated here.

[0126] Based on the same inventive concept, this specification also provides an electronic device for automatically revoking abnormal digital certificates based on CT logs. The electronic device for automatically revoking abnormal digital certificates based on CT logs in this embodiment of the invention will be described in detail below from the perspective of hardware processing.

[0127] Figure 4 This is a schematic diagram of an electronic device provided as an embodiment of this specification. Refer to the following... Figure 4 To describe the electronic device 400 according to this embodiment of the invention. Figure 4 The electronic device 400 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0128] like Figure 4 As shown, the electronic device 400 is presented in the form of a general-purpose computing device. The components of the electronic device 400 may include, but are not limited to: at least one processing unit 410, at least one storage unit 420, a bus 430 connecting different system components (including storage unit 420 and processing unit 410), a display unit 440, etc.

[0129] The storage unit stores program code that can be executed by the processing unit 410, causing the processing unit 410 to perform the steps described in the processing method section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 410 can perform, for example... Figure 1 The steps are shown.

[0130] The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 4201 and / or a cache storage unit 4202, and may further include a read-only memory unit (ROM) 4203.

[0131] The storage unit 420 may also include a program / utility 4204 having a set (at least one) program module 4205, such program module 4205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0132] Bus 430 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0133] Electronic device 400 can also communicate with one or more external devices 100 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 400, and / or with any device that enables electronic device 400 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 450. Furthermore, electronic device 400 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 460. Network adapter 460 can communicate with other modules of electronic device 400 via bus 430. It should be understood that, although... Figure 4 As not shown, other hardware and / or software modules may be used in conjunction with electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0134] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described in this invention can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the method described above according to this invention. When the computer program is executed by a data processing device, it enables the computer-readable medium to implement the method described above, i.e.: as... Figure 1 or Figure 2 The method shown.

[0135] Figure 5 This is a schematic diagram of a computer-readable medium provided for embodiments of this specification.

[0136] accomplish Figure 1 or Figure 2 The computer program of the method shown can be stored on one or more computer-readable media. A computer-readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0137] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0138] In addition, the present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the automatic revocation method for abnormal digital certificates based on CT logs as described in any of the above embodiments.

[0139] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0140] In summary, the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that in practice, general-purpose data processing devices such as microprocessors or digital signal processors (DSPs) can be used to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the present invention can be stored on a computer-readable medium or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0141] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the present invention is not inherently related to any specific computer, virtual device, or electronic device, and various general-purpose devices can also implement the present invention. The above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0142] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0143] If the technical solution of this application involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, with clear signs / information informing users of the personal information processing rules, authorization is obtained from the individual through pop-up information or by asking the individual to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0144] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for automatically revoking abnormal digital certificates based on CT logs, characterized in that, include: Obtain CT logs from multiple CT log servers, and filter out newly issued certificate records related to the target domain name from the obtained CT logs; Multiple sub-models of the fusion detection model are invoked to perform multi-dimensional parallel detection, and anomaly probability score, reconstruction error score, Boolean detection score and confidence of each score are obtained respectively. The sub-models include an isolated forest model, a temporal autoencoder model and a rule engine model. Obtain the historical accuracy information of each sub-model in the fusion detection model, the current anomaly assessment scenario characteristics, and the correlation between models; The strategy adjustment algorithm is invoked based on the historical accuracy information, the current anomaly assessment scenario features, and the inter-model correlation of each sub-model. It calculates the importance information of each sub-model in the current scenario through a multi-head attention mechanism and dynamically adjusts the fusion weights according to the importance information. The strategy adjustment algorithm is implemented based on a deep learning intelligent agent. Based on the fusion weights, the evaluation results of the anomaly probability score, reconstruction error score, Boolean detection score, and confidence level of each score are fused to obtain the anomaly risk assessment result and the confidence level of the assessment result. Based on the aforementioned abnormal risk assessment results and the confidence level of the assessment results, it is determined whether the certificate issuance records contain any abnormalities. When an abnormal certificate issuance record is detected, a certificate revocation request is submitted to the CA corresponding to the abnormal certificate issuance record to revoke the digital certificate corresponding to the abnormal certificate issuance record.

2. The method for automatic revocation of abnormal digital certificates based on CT logs as described in claim 1, characterized in that, The step of obtaining CT logs from multiple CT log servers and filtering out newly issued certificate records related to the target domain name from the obtained CT logs includes: CT log information from multiple log servers is obtained by continuously subscribing to the CT real-time stream mechanism; Determine whether the newly issued certificate information in the CT log information is a certificate information that has already undergone anomaly detection; If the certificate information has not undergone anomaly detection, then the certificate information is subjected to integrity verification to determine whether it has been tampered with. If the certificate information has not been tampered with, the preset domain name filtering requirements are received, and new certificate issuance records related to the target domain name are obtained based on the domain name filtering requirements.

3. The method for automatic revocation of abnormal digital certificates based on CT logs according to claim 1, characterized in that, After revoking the digital certificate corresponding to the abnormal certificate issuance record, the process further includes: Based on the certificate revocation data within a preset time period, the false alarm rate, false alarm rate, and revocation success rate are statistically evaluated, and normalization is performed to obtain the state vector of the revocation behavior. An adjustment strategy is generated based on the state vector of the revocation behavior, and the configuration parameters of the fusion detection model are modified based on the adjustment strategy.

4. The method for automatic revocation of abnormal digital certificates based on CT logs according to claim 3, characterized in that, After revoking the digital certificate corresponding to the abnormal certificate issuance record, the process also includes: The certificate details, abnormal risk assessment results, and adjustment strategies of the digital certificate to be revoked are packaged to obtain risk warning information; The risk warning information is pushed to a preset risk warning platform and displayed and alerted in real time.

5. An automatic revocation device for abnormal digital certificates based on CT logs, characterized in that, The automatic revocation device for abnormal digital certificates based on CT logs includes: The certificate record acquisition module is used to obtain CT logs from multiple CT log servers and filter out newly issued certificate records related to the target domain name from the obtained CT logs. An anomaly detection module is used to invoke multiple sub-models of the fusion detection model to perform multi-dimensional parallel detection, obtaining anomaly probability scores, reconstruction error scores, Boolean detection scores, and confidence levels for each score. The sub-models include an isolated forest model, a temporal autoencoder model, and a rule engine model. The module acquires historical accuracy information, current anomaly assessment scenario features, and inter-model correlations for each sub-model in the fusion detection model. It then invokes a policy adjustment algorithm based on the historical accuracy information, current anomaly assessment scenario features, and inter-model correlations of each sub-model, calculating the importance information of each sub-model in the current scenario using a multi-head attention mechanism, and dynamically adjusting the fusion weights according to the importance information. The policy adjustment algorithm is implemented based on a deep learning intelligent agent. Based on the fusion weights, the module fuses the evaluation results of the anomaly probability scores, reconstruction error scores, Boolean detection scores, and confidence levels for each score to obtain an anomaly risk assessment result and its confidence level. Finally, based on the anomaly risk assessment result and its confidence level, it determines whether there are any abnormal certificate issuance records. The certificate revocation module is used to submit a certificate revocation request to the CA corresponding to the abnormal certificate issuance record when an abnormal certificate issuance record is detected, and revoke the digital certificate corresponding to the abnormal certificate issuance record.

6. An automatic revocation device for abnormal digital certificates based on CT logs, characterized in that, The automatic revocation device for abnormal digital certificates based on CT logs includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the CT log-based automatic revocation device for abnormal digital certificates to perform the steps of the CT log-based automatic revocation method for abnormal digital certificates as described in any one of claims 1-4.

7. A computer-readable storage medium storing a computer program / instructions thereon, characterized in that, When the program / instruction is executed by the processor, it implements the steps of the automatic revocation method for abnormal digital certificates based on CT logs as described in any one of claims 1-4.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the automatic revocation method for abnormal digital certificates based on CT logs as described in any one of claims 1-4.

Images