Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Anomaly Detection in Certificate Transparency Logs

Richard Ostertág, Martin Stanek

TL;DR

This work tackles anomaly detection in Certificate Transparency logs by applying an unsupervised Isolation Forest to a large, representative sample of CT-log certificates. By engineering features across subject details, public key characteristics, issuer rarity, validity, and SAN-related extensions, the method identifies certificates that diverge from typical CT-log patterns rather than solely enforcing X.509 lint compliance. The study reveals notable outliers associated with cloud infrastructures (notably Microsoft Azure) and ZeroSSL, illustrating both operational anomalies and potential automation issues in certificate issuance. The findings demonstrate the feasibility of CT-log anomaly detection as a complementary monitoring tool, with future work suggested on domain-specific training, excluding widespread cloud certificates, and integrating linter results for richer analysis.

Abstract

We propose an anomaly detection technique for X.509 certificates utilizing Isolation Forest. This method can be beneficial when compliance testing with X.509 linters proves unsatisfactory, and we seek to identify anomalies beyond standards compliance. The technique is validated on a sample of certificates from Certificate Transparency logs.

Anomaly Detection in Certificate Transparency Logs

TL;DR

This work tackles anomaly detection in Certificate Transparency logs by applying an unsupervised Isolation Forest to a large, representative sample of CT-log certificates. By engineering features across subject details, public key characteristics, issuer rarity, validity, and SAN-related extensions, the method identifies certificates that diverge from typical CT-log patterns rather than solely enforcing X.509 lint compliance. The study reveals notable outliers associated with cloud infrastructures (notably Microsoft Azure) and ZeroSSL, illustrating both operational anomalies and potential automation issues in certificate issuance. The findings demonstrate the feasibility of CT-log anomaly detection as a complementary monitoring tool, with future work suggested on domain-specific training, excluding widespread cloud certificates, and integrating linter results for richer analysis.

Abstract

We propose an anomaly detection technique for X.509 certificates utilizing Isolation Forest. This method can be beneficial when compliance testing with X.509 linters proves unsatisfactory, and we seek to identify anomalies beyond standards compliance. The technique is validated on a sample of certificates from Certificate Transparency logs.
Paper Structure (16 sections, 3 figures, 3 tables)

This paper contains 16 sections, 3 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Anomaly detection.
  3. Our contribution.
  4. Statistics and attributes selection
  5. Subject.
  6. Subject's public key.
  7. Issuer.
  8. Signature.
  9. Validity.
  10. X509 extensions.
  11. Anomaly detection
  12. Results
  13. Azure infrastructure.
  14. Other CAs and ZeroSSL.
  15. Other observations.
  16. ...and 1 more sections

Figures (3)

  • Figure 1: Selected characteristics of subjects in the dataset
  • Figure 2: SAN count and average length in the dataset
  • Figure 3: Average number of subdomains in the dataset