发表机构
Keyfactor（Keyfactor公司）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
提出X-amine509两阶段分诊系统，用机器学习快速排序企业X.509证书风险，仅对高风险项进行确定性分析，在百万级证书上实现高精度排序与严重性分类，显著提升证书管理效率。
AI 中文摘要
管理大型X.509证书清单的企业面临一个优先级排序问题：能够精确识别标准违规的确定性分析工具对于修复工作不可或缺，但将其穷举应用于数百万份证书在操作上不可行。我们提出X-amine509，一个两阶段分诊系统，利用机器学习快速按预测风险对证书进行排序，并仅将最高风险项目路由至完整的确定性分析。证书风险被量化为一个综合评分，该评分源自177项缺陷检查，这些检查基于CA/浏览器论坛基线要求、NIST IR 8547/SP 800-57以及密码强度标准，并按四个层级的安全严重性加权，范围从密码学破解到轻微合规偏差。我们从财富500强、.gov和.edu域名收集了1,027,714份X.509证书，并使用此评分标准对每份证书进行评分。在包含201,976份证书的留出测试集上，我们最好的模型（Extra Trees）实现了R²为0.993，MAE为2.26，而决策树在单台机器上每秒处理370万份证书，R²为0.986。排序质量确认了分诊价值：聚合NDCG超过0.997，严重性层级分类在关键层级缺陷上报告了99.76%的准确率和98.90%的召回率。十三个月后，我们检索了另外571,374份证书以测试模型随时间的持久性，Extra Trees和决策树模型保持MAE低于6.8，R²至少为0.915，聚合NDCG高于0.988，严重性层级准确率至少为99.52%，关键层级召回率至少为97.03%。特征重要性分析确定有效期、扩展密钥用法配置、负序列号编码和自签名状态是最强的风险预测因子，在分诊阶段提供了粗略的可解释性。
英文摘要
Enterprises managing large X.509 certificate inventories face a prioritization problem: deterministic analysis tools that precisely identify standards violations are indispensable for remediation, but applying them exhaustively across millions of certificates is operationally impractical. We present X-amine509, a two-stage triage system that uses machine learning to rapidly rank certificates by predicted risk and route only the highest-risk items to full deterministic analysis. Certificate risk is quantified as a composite score derived from 177 defect checks grounded in CA/Browser Forum Baseline Requirements, NIST IR 8547/SP 800-57, and cryptographic strength criteria, weighted by security severity across four tiers ranging from cryptographic breaks to minor compliance deviations. We collected 1,027,714 X.509 certificates from Fortune 500, .gov, and .edu domains and scored each using this rubric. On a held-out test set of 201,976 certificates, our best model (Extra Trees) achieves $R^2$ of 0.993 with MAE of 2.26, while Decision Tree scores $R^2$ of 0.986 at 3.7 million certificates per second on a single machine. Ranking quality confirms the triage value: aggregate NDCG exceeds 0.997, and severity-tier classification reports 99.76% accuracy with 98.90% recall on critical-tier defects. Thirteen months later, we retrieved another 571,374 certificates to test our models' durability over time, and the Extra Trees and Decision Tree models maintain MAE below 6.8, $R^2$ of at least 0.915, aggregate NDCG above 0.988, severity-tier accuracy of at least 99.52%, and critical-tier recall of at least 97.03%. Feature importance analysis identifies validity period, Extended Key Usage configuration, negative serial number encoding, and self-signed status as the strongest risk predictors, providing coarse interpretability at the triage stage.
Comments22 pages, 11 figures
