Anomaly detection in certificate-based TGT requests