Detection method, system and device for mining byvirtual currency and storage medium

Abstract

The invention discloses a detection method for mining by virtual currency. According to the detection method, domain name detection is realized by using a mine pool domain name library; an IPS detection rule corresponding to the feature information existing when the controlled host executes the virtual currency mining operation is constructed by utilizing a Snort engine; namely, the network flow is detected and analyzed by using the IPS detection rule and the mine pool domain name library at the same time. The IPS detection rule can detect contents in multiple aspects based on a rule matchingmode. The defect that only the mine pool domain name library needs to be a board with known content is effectively overcome, the common point hidden behind the data can be mined from the feature information through the IPS detection rule constructed through the Snort engine, the detection effect of mined behaviors is better, and engineering implementation is easy. The invention further discloses adetection system and device for mining by the virtual currency and a computer readable storage medium, which have the above beneficial effects.

Description

technical field [0001] The present application relates to the field of detection of malicious attack means, in particular to a detection method, system, device and computer-readable storage medium for mining by virtual currency. Background technique [0002] Since the economic crisis in 2008, a virtual currency, bitcoin, has entered the public's field of vision. [0003] Unlike most currencies, Bitcoin does not rely on a specific monetary institution to issue it. It is generated through a large number of calculations based on a specific algorithm. The Bitcoin economy uses a distributed database composed of many nodes in the entire P2P network to confirm and record all transactions. And use the design of cryptography to ensure the security of all aspects of currency circulation. The biggest difference between Bitcoin and other virtual currencies is that its total quantity is very limited and extremely scarce. Its total quantity will be permanently limited to 21 million. The...

AI Technical Summary

Problems solved by technology

[0005] Due to the limited computing performance of PCs, many hackers have targeted workstations with powerful computing capabilities, intranet hosts and even large servers. Once the mining program is implanted, the mining program will take up huge CPU and GPU resources to execute Mining operations will not only cause the host to freeze and the CPU usage rate to be too high, but even cause the host to be down or paralyzed, bringing huge economic losses to the host owner

[0006] Most of the existing methods to detect whether the target host is mined are based on a single mining pool domain name library, process monitoring, or directly killing it as a virus. Since the domain name library or process monitoring can only detect the known mining pool domain name or mining programs, it cannot solve the ever-changing and increasing number of mining pools and mining programs; installing anti-virus software cannot detect non-virus mining programs, and it is necessary to install anti-virus software on each machine, which is less generalizable. Poor, the actual use effect is not ideal

Images