# Machine Learning-Based Malicious X.509 Certificates' Detection
## 4 Feature Engineering
### Extra Features  
The seven extra features are discovered with the help of what we gain already. The first one is judging whether the certificate is an Extended Validation (EV) certificate. EV certificates are issued with more checking and more expense, which makes them more credible. [PERSON] et al. [5] selected whether the certificate was an EV certificate while extracting features as well. We accomplish it with a list of certificate policies that demonstrate whether one certificate is an EV certificate or not. In addition, whether the root certificate of an end certificate is trusted by hardware and software companies, including Microsoft, Apple, Cisco, and Mozilla, is an important mark of credibility. Therefore, we obtain four features indicating the trust of Microsoft (Microsoft: [[https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFT](https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFT)]([https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFT](https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFT))), Apple (Apple: [[https://support.apple.com/en-us/HT209143](https://support.apple.com/en-us/HT209143)]([https://support.apple.com/en-us/HT209143](https://support.apple.com/en-us/HT209143))), Cisco (Cisco: [[https://www.cisco.com/security/pki/](https://www.cisco.com/security/pki/)]([https://www.cisco.com/security/pki/](https://www.cisco.com/security/pki/))), and Mozilla (Mozilla: [[https://ccadb-public.secure.force.com/mozilla/CACertificatesInFirefoxReport](https://ccadb-public.secure.force.com/mozilla/CACertificatesInFirefoxReport)]([https://ccadb-public.secure.force.com/mozilla/CACertificatesInFirefoxReport](https://ccadb-public.secure.force.com/mozilla/CACertificatesInFirefoxReport))) according to comparison of certificates' fingerprints collected from websites. Finally, the Alexa rank of the subject domain name is searched from the ranking file (Alexa rank: [[https://www.alexa.com/topsites](https://www.alexa.com/topsites)]([https://www.alexa.com/topsites](https://www.alexa.com/topsites))), and the result shows that the Alexa rank is a useful feature. Table 8 illustrates the details of extra features. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Name** & **Feature Description** & **Value Type** \\ \hline mid\_cert\_verify\_error & Whether error occurs in verifying chain of middle certificate & integer \\ \hline mid\_cert\_basic\_validate\_error & Whether error occurs in validating basic fields of & integer \\  & & middle certificate & \\ \hline verify\_result\_error & The result of verifying chain of an end certificate & integer \\ \hline unspecified\_certificate\_verification\_error & An unspecified verification error & integer \\ \hline unable\_to\_get\_issuer\_certificate & The certificate cannot get issuer’s certificate & integer \\ \hline CRL\_path\_validation\_error & Error occurs while validating Certificate revocation list(CRL) & integer \\ \hline application\_verification\_failure & An application specific error set by application callback & integer \\ \hline unable\_to\_get\_CRL\_issuer\_certificate & Cannot get issuer certificates of certificates in CRL & integer \\ \hline unhandled\_critical\_extension & The return result of OpenSSL for verifying chain of an & integer \\  & end certificate & \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Sample features from certificate chain validation.