Detection of illicit cryptomining using network metadata

Abstract

Illicit cryptocurrency mining has become one of the prevalent methods for monetization of computer security incidents. In this attack, victims’ computing resources are abused to mine cryptocurrency for the benefit of attackers. The most popular illicitly mined digital coin is Monero as it provides strong anonymity and is efficiently mined on CPUs.Illicit mining crucially relies on communication between compromised systems and remote mining pools using the de facto standard protocol Stratum. While prior research primarily focused on endpoint-based detection of in-browser mining, in this paper, we address network-based detection of cryptomining malware in general. We propose XMR-Ray, a machine learning detector using novel features based on reconstructing the Stratum protocol from raw NetFlow records. Our detector is trained offline using only mining traffic and does not require privacy-sensitive normal network traffic, which facilitates its adoption and integration.In our experiments, XMR-Ray attained 98.94% detection rate at 0.05% false alarm rate, outperforming the closest competitor. Our evaluation furthermore demonstrates that it reliably detects previously unseen mining pools, is robust against common obfuscation techniques such as encryption and proxies, and is applicable to mining in the browser or by compiled binaries. Finally, by deploying our detector in a large university network, we show its effectiveness in protecting real-world systems.

Crime Analysis Mapping with Intrusion Detection System

“…For example, the Information Sharing and Analysis Center (ISACs) are centralized nonprofit organizations that are established to facilitate the sharing of CTI and other security-related information among their members [4] They bring together organizations from a particular field or sector to share threat intelligence and best practices and collaborate on incident prevention and mitigation. ISACs are often supported by government agencies and other organizations and generally follow strict security and privacy policies to ensure that sensitive information is protected and shared only with authorized persons.However, according to a 2018 Crowdstrike Threat Intelligence report, CTI is more often seen as valuable with 72 percent planning to spend more the next three months on data mining [5]…”

The Devil is in the Details: Unwrapping the Cryptojacking Malware Ecosystem on Android

“…Unlike this study, our focus is on understanding what could get users off their guard to let apps stealthily mine coins on their devices. Earlier research works suggest the prevalence of gaming, streaming, application download, and adult content platforms with illicit mining [17], [18] on the web, but there is little scholarly work documenting illegal mining on the Android platform. We intend to fill this gap through the present study.…”