Hunting malicious TLS certificates with deep neural networks
I Torroledo, LD Camacho, AC Bahnsen - … of the 11th ACM workshop on …, 2018 - dl.acm.org
I Torroledo, LD Camacho, AC Bahnsen
Proceedings of the 11th ACM workshop on Artificial Intelligence and Security, 2018•dl.acm.orgEncryption is widely used across the internet to secure communications and ensure that
information cannot be intercepted and read by a third party. However, encryption also allows
cybercriminals to hide their messages and carry out successful malware attacks while
avoiding detection. Further aiding criminals is the fact that web browsers display a green
lock symbol in the URL bar when a connection to a website is encrypted. This symbol gives
a false sense of security to users, who are in turn more likely to fall victim to phishing attacks …
information cannot be intercepted and read by a third party. However, encryption also allows
cybercriminals to hide their messages and carry out successful malware attacks while
avoiding detection. Further aiding criminals is the fact that web browsers display a green
lock symbol in the URL bar when a connection to a website is encrypted. This symbol gives
a false sense of security to users, who are in turn more likely to fall victim to phishing attacks …
Encryption is widely used across the internet to secure communications and ensure that information cannot be intercepted and read by a third party. However, encryption also allows cybercriminals to hide their messages and carry out successful malware attacks while avoiding detection. Further aiding criminals is the fact that web browsers display a green lock symbol in the URL bar when a connection to a website is encrypted. This symbol gives a false sense of security to users, who are in turn more likely to fall victim to phishing attacks. The risk of encrypted traffic means that information security researchers must explore new techniques to detect, classify, and take countermeasures against malicious traffic. So far there exists no approach for TLS detection in the wild. In this paper, we propose a method for identifying malicious use of web certificates using deep neural networks. Our system uses the content of TLS certificates to successfully identify legitimate certificates as well as malicious patterns used by attackers. The results show that our system is capable of identifying malware certificates with an accuracy of 94.87% and phishing certificates with an accuracy of 88.64%.
ACM Digital Library