POSTER: Content-Agnostic Identification of Cryptojacking in Network Traffic

Abstract

In this paper, we propose a method that detects cryptojacking activities by analyzing content-agnostic network traffic flows. Our method first distinguishes crypto-mining activities by profiling the traffic with fast Fourier transform at each time window. It then generates the variation vectors between adjacent time windows and leverages a recurrent neural network to identify the cryptojacking patterns. Compared with the existing approaches, this method is privacy-preserving and can identify both browser-based and malware-based cryptojacking activities. Additionally, this method is easy to deploy. It can monitor all the devices within a network by accessing packet headers from the gateway router. CCS CONCEPTS • Networks → Network monitoring; • Security and privacy → Intrusion/anomaly detection and malware mitigation.

Features, Analysis Techniques, and Detection Methods of Cryptojacking Malware: A Survey

“…Features Detail Network and hash [12] src and dst Ips, src and dst port numbers, protocol, packet size, hash-rate CPU and RAM [13] CPU usage, RAM, Average Quadratic Deviation, Operative Memory, CPU Power Network [14] Traffic volume and flow times CPU [15] CPU usage at user and system kernel level, CPU idle, CPU servicing hardware and software interrupts, and CPU's hypervisor CPU [16] CPU usage CPU and hash [17] CPU usage, Usage of WebAssembly and WebWorkers, Hash and URL CPU and RAM [18] CPU and memory usage, CPU usage even after the website is closed and less inbound traffic CPU [19], [20] CPU utilization Hash [21] Hash libraries, cumulative time of websites spent on hashing Opcode and GPU [22] Rarely used opcodes Legitimate User Applications [23], [24], [20] Usage of legitimate applications to complete the operation JavaScript code injections [25], [26], [27], [12], [19] JavaScript injection is a method by which we can input and utilise our own JavaScript code in a page, whether by submitting the form in the address bar or by locating an XSS vulnerability on a website.…”

Detection of illicit cryptomining using network metadata

“…This approach is nevertheless susceptible to evasion using JavaScript obfuscation and bears a substantial operational burden associated with HTTPS proxies. Several papers [90, 91,92,93] rely on computing features upon packet flows and training binary classification machine learning models. They achieve high detection accuracy at the expenses of computation and deployment overhead.…”