Identifying self-signed certificates using http access logs for malware detection

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive traffic information regarding one or more secure sessions in the network;
• associate the one or more secure sessions with corresponding encrypted traffic flow indicated by the received traffic information;
• make a self-signed certificate determination for an endpoint domain of a particular secure session of the one or more secure sessions based on whether the corresponding encrypted traffic flow for the particular session indicates the endpoint domain issued a self-signed certificate;
• and
• cause the self-signed certificate determination for the endpoint domain to be used as input to a malware detector.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

• receiving, at the device, traffic information regarding one or more secure sessions in the network;
• associating, by the device, the one or more secure sessions with corresponding certificate validation check traffic indicated by the received traffic information;
• making, by the device, a self-signed certificate determination for an endpoint domain of a particular secure session of the one or more secure sessions based on whether the corresponding certificate validation traffic for the particular session indicates the endpoint domain issued a self-signed certificate;
• and
• causing, by the device, the self-signed certificate determination for the endpoint domain to be used as input to a malware detector.