X.509 Certificate Polymorphism Analysis for SSL/TLS Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network security tools face a significant reduction in detection ratio when dealing with malware using SSL/TLS encrypted communication channels, as they struggle to distinguish malign from benign HTTPS traffic, leading to ineffective malware detection.
Innovation Solution
A computer-implemented method analyzes X.509 certificates in SSL/TLS communications to gather and track malign certificates, determining their polymorphism and evolution over time, which enables the creation of effective IDS/IPS signatures and certificate blacklists to improve malware detection ratios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network security tools analyze encrypted SSL/TLS traffic, then detection ratio of malware is reduced, but if they use custom-made protocols, then detection becomes easier but security is compromised
Solution Approach 1:
The patent extracts and analyzes specific features from encrypted SSL/TLS traffic without requiring full decryption. By focusing on observable characteristics like certificate properties, TLS handshake parameters, and traffic patterns, the system achieves malware detection while maintaining encryption integrity and avoiding protocol complexity issues.
Solution Approach 2:
The patent introduces an intermediary analysis layer that observes SSL/TLS traffic metadata and characteristics without directly decrypting or interfering with the encrypted communication. This mediator approach enables detection of malware behavior patterns while preserving the security and integrity of encrypted protocols.
2Reliability
If malware uses standard SSL/TLS cryptographic suites, then security is improved, but detection by network security tools becomes more difficult
Solution Approach 1:
The patent applies local quality analysis by examining specific localized features within SSL/TLS traffic such as certificate issuer characteristics, domain name system (DNS) record properties, and particular TLS handshake parameters. Instead of analyzing the entire encrypted stream, the system focuses on specific local characteristics that reveal malware identity while maintaining overall communication security.
Solution Approach 2:
The patent changes the analytical approach from examining the content of encrypted traffic to analyzing the 'color' or characteristics of the traffic metadata itself - such as certificate validity periods, issuer organizational structures, and TLS version distributions. These characteristic patterns serve as indicators of malware presence without requiring decryption of the actual communication content.
3Adaptability or versatility
If HTTPS is opened for outbound traffic on port 443, then malware can reach C&C infrastructure, but benign web surfing is also enabled
Solution Approach 1:
The patent performs preliminary analysis of SSL/TLS traffic characteristics during the handshake phase and certificate validation stage, before establishing full encrypted communication. By analyzing certificate properties, TLS parameters, and traffic patterns in advance, the system can identify and block malware connections while allowing legitimate HTTPS traffic to proceed, thus preventing malware C&C communication while maintaining benign web surfing capability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer implemented method of analyzing X.509 certificates in SSL/TLS communications, and the data processing system for implementing said method, that comprises: extracting X.509 certificates from SSL/TLS Handshake protocols; monitoring each extracted X.509 certificate for evaluating, using the processor, a grade of polymorphism that the X.509 certificate exhibits; and, storing the X.509 certificate in the certificate database if the X.509 certificate is not previously stored in the certificate database or, if the X.509 certificate exhibits a grade of polymorphism with respect to a previously stored version of the X.509 certificate.