Empirical Analysis of SSL/TLS Weaknesses in Real Websites: Who Cares?

Oh, Sanghak; Kim, Eun-Soo; Kim, Hyoungshick

doi:10.1007/978-3-319-56549-1_15

Cited by 2 publications

(1 citation statement)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While many revisions and alterations have been required to patch the protocols, no cryptographic vulnerability is known to exist that would allow to fully compromise the underlying end-to-end security model. This said, a number of high-profile TLS/SSL vulnerabilities (including the so-called Heartbleed, FREAK, and DROWN) have been discovered and disclosed in recent years [25,34]. In addition to these vulnerabilities, a long-standing weakness originates from the global PKI and its CA-based trust model [12,16].…”

Section: Introductionmentioning

confidence: 99%

An empirical survey on the early adoption of DNS certification authority authorization

Ruohonen

2019

Journal of Cyber Security Technology

View full text Add to dashboard Cite

A new certification authority authorization (CAA) resource record for the domain name system (DNS) was standardized in 2013. Motivated by the later 2017 decision to enforce mandatory CAA checking for most certificate authorities, this paper surveys the early adoption of CAA by using an empirical sample collected from the Alexa's top-million domains. According to the results, (i) the adoption of CAA is still at a modest level; only a little below two percent of the popular domains sampled have adopted CAA. Among the domains that have adopted CAA, (ii) authorizations dealing with wildcard certificates are rare compared to conventional certificates. Interestingly, (iii) the results only partially reflect the market structure of the global certificate business. With these timely results, the paper contributes to the ongoing large-scale empirical research on the use of encryption technologies.

show abstract

Section: Introductionmentioning

confidence: 99%

An empirical survey on the early adoption of DNS certification authority authorization

Ruohonen

2019

Journal of Cyber Security Technology

View full text Add to dashboard Cite

show abstract

Malcertificate: Research and Implementation of a Malicious Certificate Detection Algorithm Based on GCN

et al. 2022

View full text Add to dashboard Cite

Encryption is widely used to ensure the security and confidentiality of information. Because people trust in encryption technology, a series of attack methods based on certificates have been derived. Malicious certificates protect many malicious behaviors and threaten data security. To counter this threat, machine learning algorithms are widely used in malicious certificate detection. However, the detection efficiency of such algorithms largely depends on whether the extracted features can effectively represent the data. In contrast, graph convolutional networks (GCNs) can automatically extract useful features. GCNs are powerful at fitting graph data, which can improve the effectiveness of learning systems by efficiently embedding prior knowledge in an end-to-end manner. In this paper, we propose an algorithm for detecting malicious digital certificates with GCNs. Firstly, we transform the digital certificate dataset with pem document structure into a corpus of graph structure based on attribute co-occurrence and document attribute relations. Then, we put the graph structure certificate dataset into a GCN for training. The results of the experiment show that GCN is very effective in certificate classification and outperforms traditional machine learning algorithms and extant neural network algorithms. The accuracy of our algorithm to detect malicious certificates is 97.41%. This shows that our algorithm is very effective.

show abstract

Empirical Analysis of SSL/TLS Weaknesses in Real Websites: Who Cares?

Cited by 2 publications

References 8 publications

An empirical survey on the early adoption of DNS certification authority authorization

An empirical survey on the early adoption of DNS certification authority authorization

Malcertificate: Research and Implementation of a Malicious Certificate Detection Algorithm Based on GCN

Contact Info

Product

Resources

About