Manara - Qatar Research Repository
Browse
1-s2.0-S0140366421000797-main.pdf (1.22 MB)

Cryptomining makes noise: Detecting cryptojacking via Machine Learning

Download (1.22 MB)
journal contribution
submitted on 2023-09-04, 11:17 and posted on 2023-09-19, 04:50 authored by Maurantonio Caprolu, Simone Raponi, Gabriele Oligeri, Roberto Di Pietro

Cryptojacking occurs when an adversary illicitly runs crypto-mining software over the devices of unaware users. This novel cybersecurity attack, that is emerging in both the literature and in the wild, has proved to be very effective given the simplicity of running a crypto-client into a target device. Several countermeasures have recently been proposed, with different features and performance, but all characterized by a host-based architecture. The cited solutions, designed to protect the individual user, are not suitable for efficiently protecting a corporate network, especially against insiders. In this paper, we propose a network-based approach to detect and identify crypto-clients activities by solely relying on the network traffic, even when encrypted and mixed with non-malicious traces. First, we provide a detailed analysis of the real network traces generated by three major cryptocurrencies, Bitcoin, Monero, and Bytecoin, considering both the normal traffic and the one shaped by a VPN. Then, we propose Crypto-Aegis, a Machine Learning (ML) based framework built over the results of our investigation, aimed at detecting cryptocurrencies related activities, e.g., pool mining, solo mining, and active full nodes. Our solution achieves a striking 0.96 of F1-score and 0.99 of AUC for the ROC, while enjoying a few other properties, such as device and infrastructure independence. Given the extent and novelty of the addressed threat we believe that our approach, supported by its excellent results, pave the way for further research in this area.

Other Information

Published in: Computer Communications
License: https://creativecommons.org/licenses/by/4.0/
See article on publisher's website: https://dx.doi.org/10.1016/j.comcom.2021.02.016

Funding

Open Access funding provided by the Qatar National Library

History

Language

  • English

Publisher

Elsevier

Publication Year

  • 2021

License statement

This Item is licensed under the Creative Commons Attribution 4.0 International License

Institution affiliated with

  • Hamad Bin Khalifa University
  • College of Science and Engineering - HBKU