MineCap: super incremental learning for detecting and blocking cryptocurrency mining on software-defined networking

Neto, Helio N. Cunha; Lopez, Martin Andreoni; Fernandes, Natália C.; Mattos, Diogo M. F.

doi:10.1007/s12243-019-00744-4

Cited by 12 publications

(15 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Network-based Detection: As a network-level detection mechanism, Neto et al [29] proposed MineCap, a networkflow-based detection and blocking mechanism to protect the network of devices controlled by the SDN controller. MineCap relies on Apache Spark Streaming library and incremental ML model to detect the cryptocurrency mining flows.…”

Section: A Malicious Cryptocurreny Mining Detection Systemsmentioning

confidence: 99%

“…For instance, one of the features used by OUTGUARD [12] (i.e., MessageLoop event) is browserdependent. MineCap [29] can be utilized only by operators which employ SDN in their networks. Therefore, individual users cannot use it.…”

Section: B Challenges and Need For A New Detection Systemmentioning

confidence: 99%

“…Vladimír andŽádník [28] relied on the network flow features and active probing the miner servers. MineCap [29] employed network-flow-based detection via Apache Spark Streaming library and incremental ML model.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

MINOS: A Lightweight Real-Time Cryptojacking Detection System

Naseem¹,

Arış²,

Babun³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Emerging WebAssembly(Wasm)-based cryptojacking malware covertly uses the computational resources of users without their consent or knowledge. Indeed, most victims of this malware are unaware of such unauthorized use of their computing power due to techniques employed by cryptojacking malware authors such as CPU throttling and obfuscation. A number of dynamic analysis-based detection mechanisms exist that aim to circumvent such techniques. However, since these mechanisms use dynamic features, the collection of such features, as well as the actual detection of the malware, require that the cryptojacking malware run for a certain amount of time, effectively mining for that period, and therefore causing significant overhead. To solve these limitations, in this paper, we propose MINOS, a novel, extremely lightweight cryptojacking detection system that uses deep learning techniques to accurately detect the presence of unwarranted Wasm-based mining activity in real-time. MINOS uses an image-based classification technique to distinguish between benign webpages and those using Wasm to implement unauthorized mining. Specifically, the classifier implements a convolutional neural network (CNN) model trained with a comprehensive dataset of current malicious and benign Wasm binaries. MINOS achieves exceptional accuracy with a low TNR and FPR. Moreover, our extensive performance analysis of MINOS shows that the proposed detection technique can detect mining activity instantaneously from the most current in-the-wild cryptojacking malware with an accuracy of 98.97%, in an average of 25.9 milliseconds while using a maximum of 4% of the CPU and 6.5% of RAM, proving that MINOS is highly effective while lightweight, fast, and computationally inexpensive. * Minos is the beast in Dante's Divine Comedy that acts as a judge in underworld and decides which layer of the hell the sinner goes to.

show abstract

Section: A Malicious Cryptocurreny Mining Detection Systemsmentioning

confidence: 99%

Section: B Challenges and Need For A New Detection Systemmentioning

confidence: 99%

See 1 more Smart Citation

MINOS: A Lightweight Real-Time Cryptojacking Detection System

Naseem¹,

Arış²,

Babun³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…They collected 1500 active Windows Portable Executable (PE32) cryptocurrency mining malware samples registered in 2018 and used the Cuckoo Sandbox [129] to obtain detailed behavioral reports on those samples. Furthermore, the studies in [107], [108], [111], [124] performed their analysis by installing the legitimate mining scripts, and the studies in [110], [114] manually injected miners to the websites to test their detection mechanisms. [105], [106], [108]- [112], [114], [115], [124], [130] are proposed for the detection of in-browser cryptojacking malware.…”

Section: Cryptojacking Detection Studiesmentioning

confidence: 99%

SoK: Cryptojacking Malware

Tekiner

Acar

Uluagac

et al. 2021

2021 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

Emerging blockchain and cryptocurrency-based technologies are redefining the way we conduct business in cyberspace. Today, a myriad of blockchain and cryptocurrency systems, applications, and technologies are widely available to companies, end-users, and even malicious actors who want to exploit the computational resources of regular users through cryptojacking malware. Especially with ready-to-use mining scripts easily provided by service providers (e.g., Coinhive) and untraceable cryptocurrencies (e.g., Monero), cryptojacking malware has become an indispensable tool for attackers. Indeed, the banking industry, major commercial websites, government and military servers (e.g., US Dept. of Defense), online video sharing platforms (e.g., Youtube), gaming platforms (e.g., Nintendo), critical infrastructure resources (e.g., routers), and even recently widely popular remote video conferencing/meeting programs (e.g., Zoom during the Covid-19 pandemic) have all been the victims of powerful cryptojacking malware campaigns. Nonetheless, existing detection methods such as browser extensions that protect users with blacklist methods or antivirus programs with different analysis methods can only provide a partial panacea to this emerging cryptojacking issue as the attackers can easily bypass them by using obfuscation techniques or changing their domains or scripts frequently. Therefore, many studies in the literature proposed cryptojacking malware detection methods using various dynamic/behavioral features. However, the literature lacks a systemic study with a deep understanding of the emerging cryptojacking malware and a comprehensive review of studies in the literature. To fill this gap in the literature, in this SoK paper, we present a systematic overview of cryptojacking malware based on the information obtained from the combination of academic research papers, two large cryptojacking datasets of samples, and 45 major attack instances. Finally, we also present lessons learned and new research directions to help the research community in this emerging area.

show abstract

“…This approach is nevertheless susceptible to evasion using JavaScript obfuscation and bears a substantial operational burden associated with HTTPS proxies. Several papers [90][91][92][93] rely on computing features upon packet flows and training binary classification machine learning models. They achieve high detection accuracy at the expenses of computation and deployment overhead.…”

Section: Network-based Detectionmentioning

confidence: 99%

Detection of illicit cryptomining using network metadata

Russo

Šrndić

Laskov

2021

EURASIP J. on Info. Security

View full text Add to dashboard Cite

Illicit cryptocurrency mining has become one of the prevalent methods for monetization of computer security incidents. In this attack, victims’ computing resources are abused to mine cryptocurrency for the benefit of attackers. The most popular illicitly mined digital coin is Monero as it provides strong anonymity and is efficiently mined on CPUs.Illicit mining crucially relies on communication between compromised systems and remote mining pools using the de facto standard protocol Stratum. While prior research primarily focused on endpoint-based detection of in-browser mining, in this paper, we address network-based detection of cryptomining malware in general. We propose XMR-Ray, a machine learning detector using novel features based on reconstructing the Stratum protocol from raw NetFlow records. Our detector is trained offline using only mining traffic and does not require privacy-sensitive normal network traffic, which facilitates its adoption and integration.In our experiments, XMR-Ray attained 98.94% detection rate at 0.05% false alarm rate, outperforming the closest competitor. Our evaluation furthermore demonstrates that it reliably detects previously unseen mining pools, is robust against common obfuscation techniques such as encryption and proxies, and is applicable to mining in the browser or by compiled binaries. Finally, by deploying our detector in a large university network, we show its effectiveness in protecting real-world systems.

show abstract

MineCap: super incremental learning for detecting and blocking cryptocurrency mining on software-defined networking

Cited by 12 publications

References 18 publications

MINOS: A Lightweight Real-Time Cryptojacking Detection System

MINOS: A Lightweight Real-Time Cryptojacking Detection System

SoK: Cryptojacking Malware

Detection of illicit cryptomining using network metadata

Contact Info

Product

Resources

About