Abstract
With the rapid development of blockchain, cryptocurrency gains more attention due to its anonymity and decentralization. However, illegal cryptocurrency mining problems, e.g., unauthorized control of victims’ devices or appropriate public resources, become more and more serious. Existing mining detection methods need to be deployed locally and require authorization from administrators, which hardly supervise an entire network segment, as it brings high installation and maintenance costs. To solve this problem, in this paper, we propose a lightweight mining behavior detection method based on traffic analysis, which leverages communication packets in the first n seconds of a flow to achieve a real-time response. The experiment results with real-world datasets prove that the proposed method can achieve 94.04% F1 score using only the first 40 s packets, 98.22% F1 score using the first 120 s packets. Moreover, it can realize unknown cryptomining service discovery for about 96.37% F1 score. Instead of installing antivirus software on the host, the proposed method based on traffic analysis can be deployed at the gateways, which brings convenience for network management.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
FOFA. https://fofa.info/
CryptoLoot (2022). https://www.crypto-webminer.com/integrate.html?. Accessed 17 May 2022
Mining pool (2022). https://miningpoolstats.stream/monero. Accessed 20 May 2022
Stratum (2022). https://zh.braiins.com/stratum-v1/docs. Accessed 17 May 2022
XMRig (2022). https://xmrig.com/. Accessed 20 May 2022
Bijmans, H.L., Booij, T.M., Doerr, C.: Inadvertently making cyber criminals rich: a comprehensive study of cryptojacking campaigns at internet scale. In: 28th USENIX Security Symposium (USENIX Security 2019), Santa Clara, CA, pp. 1627–1644. USENIX Association, August 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/bijmans
Eskandari, S., Leoutsarakos, A., Mursch, T., Clark, J.: A first look at browser-based cryptojacking. In: 2018 IEEE European Symposium on Security and Privacy Workshops (EuroS &PW), pp. 58–66. IEEE (2018)
Gomes, F., Correia, M.: Cryptojacking detection with CPU usage metrics. In: 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA), pp. 1–10. IEEE (2020)
Hong, G., et al.: How you get shot in the back: a systematical study about cryptojacking in the real world. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1701–1713 (2018)
Hu, X., Shu, Z., Song, X., Cheng, G., Gong, J.: Detecting cryptojacking traffic based on network behavior features. In: 2021 IEEE Global Communications Conference (GLOBECOM), pp. 01–06. IEEE (2021)
Kharraz, A., et al.: Outguard: detecting in-browser covert cryptocurrency mining in the wild. In: The World Wide Web Conference, pp. 840–852 (2019)
Konoth, R.K., et al.: MineSweeper: an in-depth look into drive-by cryptocurrency mining and its defense. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1714–1730 (2018)
Musch, M., Wressnegger, C., Johns, M., Rieck, K.: Web-based cryptojacking in the wild. arXiv preprint arXiv:1808.09474 (2018)
Naseem, F., Aris, A., Babun, L., Tekiner, E., Uluagac, S.: Minos: a lightweight real-time cryptojacking detection system. In: 28th Annual Network and Distributed System Security Symposium, NDSS (2021)
Pastor, A., et al.: Detection of encrypted cryptomining malware connections with machine and deep learning. IEEE Access 8, 158036–158055 (2020)
Shen, M., Duan, J., Zhu, L., Zhang, J., Du, X., Guizani, M.: Blockchain-based incentives for secure and collaborative data sharing in multiple clouds. IEEE J. Sel. Areas Commun. 38(6), 1229–1241 (2020)
Shen, M., Gao, Z., Zhu, L., Xu, K.: Efficient fine-grained website fingerprinting via encrypted traffic analysis with deep learning. In: 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS), pp. 1–10. IEEE (2021)
Shen, M., et al.: Blockchain-assisted secure device authentication for cross-domain industrial iot. IEEE J. Sel. Areas Commun. 38(5), 942–954 (2020)
Shen, M., Liu, Y., Zhu, L., Du, X., Hu, J.: Fine-grained webpage fingerprinting using only packet length information of encrypted traffic. IEEE Trans. Inf. Forensics Secur. 16, 2046–2059 (2020)
Shen, M., Ma, B., Zhu, L., Mijumbi, R., Du, X., Hu, J.: Cloud-based approximate constrained shortest distance queries over encrypted graphs with privacy protection. IEEE Trans. Inf. Forensics Secur. 13(4), 940–953 (2017)
Shen, M., Zhang, J., Zhu, L., Xu, K., Du, X.: Accurate decentralized application identification via encrypted traffic analysis using graph neural networks. IEEE Trans. Inf. Forensics Secur. 16, 2367–2380 (2021)
Varlioglu, S., Gonen, B., Ozer, M., Bastug, M.: Is cryptojacking dead after coinhive shutdown? In: 2020 3rd International Conference on Information and Computer Technologies (ICICT), pp. 385–389. IEEE (2020)
Zhang, S., et al.: MineHunter: a practical cryptomining traffic detection algorithm based on time series tracking. In: Annual Computer Security Applications Conference, pp. 1051–1063 (2021)
Acknowledgments
This work is supported by National Key R &D Program of China with No. 2020YFB1006101.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Ye, K., Shen, M., Gao, Z., Zhu, L. (2022). Real-Time Detection of Cryptocurrency Mining Behavior. In: Svetinovic, D., Zhang, Y., Luo, X., Huang, X., Chen, X. (eds) Blockchain and Trustworthy Systems. BlockSys 2022. Communications in Computer and Information Science, vol 1679. Springer, Singapore. https://doi.org/10.1007/978-981-19-8043-5_20
Download citation
DOI: https://doi.org/10.1007/978-981-19-8043-5_20
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-19-8042-8
Online ISBN: 978-981-19-8043-5
eBook Packages: Computer ScienceComputer Science (R0)