Anomaly Detection in Certificate Transparency Logs

TL;DR

This paper introduces an anomaly detection method for X.509 certificates using Isolation Forest, aiming to identify anomalies beyond standard compliance, validated on Certificate Transparency logs.

Contribution

It presents a novel anomaly detection approach for certificates that surpasses traditional compliance testing methods.

Findings

Effective detection of anomalies in certificate logs

Outperforms standard compliance testing in identifying irregularities

Validated on real-world Certificate Transparency data

Abstract

We propose an anomaly detection technique for X.509 certificates utilizing Isolation Forest. This method can be beneficial when compliance testing with X.509 linters proves unsatisfactory, and we seek to identify anomalies beyond standards compliance. The technique is validated on a sample of certificates from Certificate Transparency logs.