Probabilistic Classifiers for Certificates

摘要

Classifiers may be used to analyze a valid certificate received from an unverified entity in an attempt to establish a secure connection with the unverified entity. The classifiers may determine a probability that the certificate is being used improperly by an unauthorized third party. An action may be taken based on the probability, such as allowing the unverified entity to establish a secure connection, blocking the unverified entity from establishing a secure connection, etc. The classifiers may be trained by employing machine learning techniques on a collection of valid, authorized certificates. Additionally, or alternatively, received certificates may be sampled for further analysis based on the probability and/or predefined sampling percentages.

主权项

1. A computing device comprising:
one or more processors; a display communicatively coupled to the one or more processors and configured to display content; memory communicatively coupled to the one or more processors; a communication module stored in the memory and executable by the one or more processors to:
receive, from an unverified entity, a request to perform an operation with the unverified entity, the operation relating to communication with the unverified entity over a secure channel; andreceive, from the unverified entity, a certificate associated with the unverified entity; a selection module stored in the memory and executable by the one or more processors to determine one or more classifiers to employ based at least in part on one or more characteristics of the certificate; and the one or more classifiers executable by the one or more processors to:
determine that the certificate is valid and determine a probability that the certificate is being used improperly;cause the certificate to be stored in the memory based at least in part on a sampling percentage associated with the probability that the valid certificate is being used improperly;determine an action to be performed based at least in part on the probability that the certificate is being used improperly; andcause the stored certificate to be sent to a server to update classifier training data.