# US 10,375,097 B2 · Identifying self-signed certificates using HTTP access logs for malware detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,375,097 B2
- Document ID: US10375097B2
- Status: Granted
- Kind: B2
- Application number: 15/386,006
- Filed: 2016-12-21
- Published: 2018-06-21
- Granted: 2019-08-06
- Earliest claimed: 2016-12-21
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Martin Kopp; Martin Grill; Jan Kohout
- Web page: https://patentgrep.com/patent/US10375097B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/166: {at the transport layer}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In one embodiment, a device in a network receives traffic information regarding one or more secure sessions in the network. The device associates the one or more secure sessions with corresponding certificate validation check traffic indicated by the received traffic information. The device makes a self-signed certificate determination for an endpoint domain of a particular secure session based on whether the particular secure session is associated with certificate validation check traffic. The device causes the self-signed certificate determination for the endpoint domain to be used as input to a malware detector.

## Claims

### Claim 1

A method, comprising:
receiving, at a device in a network, traffic information regarding one or more secure sessions in the network;
associating, by the device, the one or more secure sessions with corresponding certificate validation check traffic indicated by the received traffic information;
determining, by the device, that an endpoint domain used a self-signed certificate in a particular secure session of the one or more secure sessions based on the particular secure session not being associated with the certificate validation check traffic;
making, by the device, a self-signed certificate determination for the endpoint domain of the particular secure session based on the determination that the endpoint domain used the self-signed certificate in the particular secure session; and
causing, by the device, the self-signed certificate determination for the endpoint domain to be used as input to a malware detector.

### Claim 2 (depends on 1)

The method as in claim 1, wherein the malware detector causes the performance of a mitigation action in the network when the malware detector detects malware.

### Claim 3 (depends on 1)

The method as in claim 1, wherein the malware detector is configured to treat a self-signed certificate for a domain as an indication of the presence of malware in the network.

### Claim 4 (depends on 1)

The method as in claim 1, wherein the traffic information regarding the one or more secure sessions comprises Hypertext Transfer Protocol (HTTP) access logs regarding HTTP traffic associated with the one or more secure sessions.

### Claim 5 (depends on 1)

The method as in claim 1, wherein associating the one or more secure sessions with corresponding certificate validation check traffic comprises:
matching, by the device, client addresses of the one or more secure sessions with client addresses of the certificate validation check traffic.

### Claim 6 (depends on 1)

The method as in claim 1, wherein the certificate validation check traffic comprises a certificate revocation list (CRL) download or an Online Certificate Status Protocol (OCSP) check.

### Claim 7 (depends on 1)

The method as in claim 1, wherein the self-signed certificate determination for the endpoint domain is based on whether any of the one or more secure sessions involving the endpoint domain are associated with certificate validation check traffic.

### Claim 8 (depends on 1)

The method as in claim 1, wherein receiving the traffic information regarding the one or more secure sessions in the network comprises:
capturing, by the device, the traffic information regarding the one or more secure sessions in the network.

### Claim 9

An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive traffic information regarding one or more secure sessions in the network;
associate the one or more secure sessions with corresponding certificate validation check traffic indicated by the received traffic information;
determine that an endpoint domain used a self-signed certificate in a particular secure session of the one or more secure sessions based on the particular secure session not being associated with the certificate validation check traffic;
make a self-signed certificate determination for the endpoint domain of the particular secure session based on the determination that the endpoint domain used the self-signed certificate in the particular secure session; and
cause the self-signed certificate determination for the endpoint domain to be used as input to a malware detector.

### Claim 10 (depends on 9)

The apparatus as in claim 9, wherein the malware detector causes the performance of a mitigation action in the network when the malware detector detects malware.

### Claim 11 (depends on 9)

The apparatus as in claim 9, wherein the malware detector is configured to treat a self-signed certificate for a domain as an indication of the presence of malware in the network.

### Claim 12 (depends on 9)

The apparatus as in claim 9, wherein the traffic information regarding the one or more secure sessions comprises Hypertext Transfer Protocol (HTTP) access logs regarding HTTP traffic associated with the one or more secure sessions.

### Claim 13 (depends on 9)

The apparatus as in claim 9, wherein the apparatus associates the one or more secure sessions with corresponding certificate validation check traffic by:
matching client addresses of the one or more secure sessions with client addresses of the certificate validation check traffic.

### Claim 14 (depends on 9)

The apparatus as in claim 9, wherein the certificate validation check traffic comprises a certificate revocation list (CRL) download or an Online Certificate Status Protocol (OCSP) check.

### Claim 15 (depends on 9)

The apparatus as in claim 9, wherein the self-signed certificate determination for the endpoint domain is based on whether any of the one or more secure sessions involving the endpoint domain are associated with certificate validation check traffic.

### Claim 16 (depends on 9)

The apparatus as in claim 9, wherein the apparatus receives the traffic information regarding the one or more secure sessions in the network by:
capturing the traffic information regarding the one or more secure sessions in the network.

### Claim 17

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:
receiving, at the device, traffic information regarding one or more secure sessions in the network;
associating, by the device, the one or more secure sessions with corresponding certificate validation check traffic indicated by the received traffic information;
determining, by the device, that an endpoint domain used a self-signed certificate in a particular secure session of the one or more secure sessions based on the particular secure session not being associated with the certificate validation check traffic;
making, by the device, a self-signed certificate determination for the endpoint domain of the particular secure session based on the determination that the endpoint domain used the self-signed certificate in the particular secure session; and
causing, by the device, the self-signed certificate determination for the endpoint domain to be used as input to a malware detector.