Method for detecting mining virtual currency, equipment and storage medium

Abstract

The invention discloses a method for detecting mining virtual currency, equipment and a storage medium. The method comprises the following steps of: forming a virtual currency mine pool information library; generating a virtual currency mine pool domain name AI detection model; acquiring dNS metadata and Netflow flow information, carrying out domain name matching on a requested domain name and a virtual currency mine pool information library, and when matching succeeds, comparing an IP address corresponding to the requested domain name and a port corresponding to the IP address with Netflow flow information to judge whether a mining behavior exists or not; when the domain name matching is unsuccessful, detecting the requested domain name by using the AI detection model; and when a highly suspicious mine pool domain name is detected, performing service scanning by using a mine pool service detection component, and comparing a port and an IP address obtained by scanning with the Netflowflow information to judge whether a mining behavior exists or not. According to the method, the mining behavior can be accurately detected, and misinformation is avoided.

Description

technical field [0001] The invention relates to the field of virtual currency mining detection, in particular to a method, equipment and storage medium for detecting mining virtual currency. Background technique [0002] With the increase in the price of virtual cryptocurrencies, mining has become the most direct means of cashing out after hacking servers. A large number of mining Trojan horses and worms have invaded servers in the network, stealing server resources for mining activities. How to accurately and quickly discover mining behavior in the network has become a very important job for network operators. [0003] Mining generally adopts Stratum, GetWork, and GetBlockTemplate protocols. The current solution mainly uses feature signatures to identify mining protocols. For example, using IPS signature-based matching technology to identify mining behavior and determine whether the application program has accessed the domain name related to the virtual currency mining po...

AI Technical Summary

Problems solved by technology

[0004] 1. In order to evade the detection method based on signature technology, attackers add obfuscation technology to the communication process of the mining protocol, which makes the signature-based detection technology invalid. Many attacks have even begun to use HTTPS to encrypt mining communication traffic. The current detection scheme Unable to detect mining behavior using https encryption

[0005] 2. Only judging the domain name of the virtual currency mining pool node will have a large number of false positives. For example, port 80 of the general virtual currency mining pool domain name is used to provide HTTP website services, but ports 3333 and 443 are used to provide mining services

When the user goes to view related websites or visits the advertising links of related websites, it will be falsely detected

[0006] 3. The existing scheme is based on full domain name matching. The virtual currency mining pool provider will change the domain name prefix when expanding nodes, which cannot be detected by the full domain name detection system

[0007] 4. The attacker deploys the virtual currency mining pool node by itself, and does not announce the domain name of the mining pool node or access it directly through IP. The detection system based on the domain name cannot detect this situation

Images