Detecting Covert Cryptomining using HPC
Detecting Covert Cryptomining using HPC
复制标题
使用 HPC 检测隐蔽加密货币挖矿
DOI：
10.1007/978-3-030-65411-5_17
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Samuele Giuliano Piazzetta
中科院分区：
文献类型：
--
作者：
M. Conti;Ankit Gangwal;Gianluca Lain;Samuele Giuliano Piazzetta
网络犯罪分子一直在利用加密货币进行各种独特的金融欺诈。隐蔽的加密挖矿-被定义为未经授权利用受害者的计算资源来挖掘加密货币-是当今网络犯罪分子用来赚取经济利益的流行方式之一。这种对资源的剥削给受害者造成了经济损失。
在本文中，我们提出了我们的新的和有效的方法来检测隐蔽加密。我们的解决方案是一个通用的解决方案，与目前可用的检测隐蔽加密挖矿的解决方案不同，它不是针对特定的加密货币或特定形式的加密挖矿而量身定制的。特别是，我们专注于核心挖掘算法，并利用硬件性能计数器（HPC）创建干净的签名，掌握这些算法在处理器上的执行模式。我们采用先进的机器学习技术构建了解决方案的完整实现。我们评估了我们的方法在两个不同的处理器上通过一组详尽的实验。在我们的实验中，我们考虑了前10大矿池开采的所有加密货币，它们共同代表了加密挖矿市场的最大份额（2018年第三季度为84%）。我们的研究结果表明，我们的分类器可以实现一个近乎完美的分类与样本的长度低至5秒。由于其强大而实用的设计，我们的解决方案甚至可以适应零日加密货币。最后，我们相信我们的解决方案是可扩展的，可以部署来解决隐蔽加密挖矿的问题。
Cybercriminals have been exploiting cryptocurrencies to commit various unique financial frauds. Covert cryptomining - which is defined as an unauthorized harnessing of victims' computational resources to mine cryptocurrencies - is one of the prevalent ways nowadays used by cybercriminals to earn financial benefits. Such exploitation of resources causes financial losses to the victims.
In this paper, we present our novel and efficient approach to detect covert cryptomining. Our solution is a generic solution that, unlike currently available solutions to detect covert cryptomining, is not tailored to a specific cryptocurrency or a particular form of cryptomining. In particular, we focus on the core mining algorithms and utilize Hardware Performance Counters (HPC) to create clean signatures that grasp the execution pattern of these algorithms on a processor. We built a complete implementation of our solution employing advanced machine learning techniques. We evaluated our methodology on two different processors through an exhaustive set of experiments. In our experiments, we considered all the cryptocurrencies mined by the top-10 mining pools, which collectively represent the largest share (84% during Q3 2018) of the cryptomining market. Our results show that our classifier can achieve a near-perfect classification with samples of length as low as five seconds. Due to its robust and practical design, our solution can even adapt to zero-day cryptocurrencies. Finally, we believe our solution is scalable and can be deployed to tackle the uprising problem of covert cryptomining.
MineSweeper：深入研究路过式加密货币挖矿及其防御
DOI：
10.1145/3243734.3243858
发表时间：
2018
期刊：
2018 ACM SIGSAC Conference on Computer and Communications Security
影响因子：
--
作者：
Konoth, Radhesh Krishnan;Vineti, Emanuele;Moonsamy, Veelasha;Lindorfer, Martina;Kruegel, Christopher;Bos, Herbert;Vigna, Giovanni
通讯作者：
Vigna, Giovanni