Real-time detection method for crypto-hijacking on Linux platform based on multi-dimensional behavioral characteristics

Abstract

This invention relates to a real-time detection method for encryption hijacking on Linux platforms based on multi-dimensional behavioral characteristics. This method relies on a closed-loop governance system formed by the collaborative analysis and processing module and the decision output module. The triggering logic of the three-layer cascaded analysis is as follows: the resource monitoring layer performs real-time monitoring and initial anomaly screening of system-level hardware resource indicators, outputting system-level risk status identifiers; when any monitoring indicator is abnormal, the behavior analysis layer is activated; the behavior analysis layer collects and analyzes process-level behavioral characteristics, outputting a list of suspicious processes and their risk scores; when the process risk score exceeds a set threshold, the essence detection layer is triggered; the essence detection layer performs encryption hijacking essence behavior verification on suspicious processes, completing the final decision. The main objective of this invention is to eliminate reliance on variable features and instead construct a detection mechanism that is difficult to circumvent, has a low false alarm rate, and can respond in real time based on the core essence behavior of encryption hijacking.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a real-time detection method for encryption hijacking on the Linux platform based on multi-dimensional behavioral characteristics. Background Technology

[0002] In recent years, cryptojacking has become one of the major threats to cybersecurity. Attackers implant mining trojans to illegally hijack victims' computing resources, causing significant financial losses. However, existing mainstream detection technologies have inherent flaws and are ill-equipped to counter the constantly evolving attack methods.

[0003] (1) Detection based on network traffic analysis: Since communication generally uses SSL / TLS encryption, this method cannot parse the payload, causing the identification method based on protocol characteristics to fail;

[0004] (2) Detection based on static code analysis: This method relies heavily on known malicious code signatures. Attackers can easily change binary features through code obfuscation, repackaging and other means, which leads to the rapid obsolescence of the feature library and a sharp decline in detection capability.

[0005] (3) Detection based on system resource monitoring: Although it can detect abnormalities such as CPU utilization and power consumption, attackers can easily simulate normal load by using strategies such as dynamic frequency adjustment and intermittent operation, resulting in a very high false alarm rate for this method;

[0006] (4) Detection based on API call tracing: Malicious programs can bypass the monitoring of standard cryptographic library APIs by customizing system functions or directly calling underlying instruction sets (such as SSE / AVX), which greatly increases the maintenance cost of this method and makes it easy to bypass.

[0007] Ultimately, all the aforementioned traditional methods share the same common flaw: they rely too heavily on variable external features in the attack chain (such as code signatures, network traffic, and resource peaks), while lacking in-depth modeling and capture of the immutable essential behavior of crypto-hijacking, namely, the frequent and specific memory access patterns of blockchain data structures.

[0008] Therefore, there is an urgent need in this field for a breakthrough solution that can abandon the reliance on variable features and instead build a detection mechanism that is difficult to circumvent, has a low false alarm rate, and can respond in real time based on the core essential behavior of crypto-hijacking. This is precisely the technical problem that this invention aims to solve. Summary of the Invention

[0009] The main objective of this invention is to provide a real-time detection method for crypto-hijacking on the Linux platform based on multi-dimensional behavioral characteristics. This method can eliminate the reliance on variable features and instead build a detection mechanism that is difficult to circumvent, has a low false alarm rate, and can respond in real time based on the core essential behavior of crypto-hijacking.

[0010] To achieve the above objectives, this invention provides a real-time detection method for encryption hijacking on the Linux platform based on multi-dimensional behavioral characteristics. This method is implemented by relying on a closed-loop governance system formed by the collaborative analysis and processing module and the decision output module. The analysis and processing module executes a three-layer cascaded analysis process consisting of a resource monitoring layer, a behavior analysis layer, and an essence detection layer. The decision output module executes response operations based on the analysis results of the analysis and processing module.

[0011] The triggering logic of the three-layer cascaded analysis is as follows: The resource monitoring layer performs real-time monitoring and initial screening of system-level hardware resource indicators, outputs system-level risk status indicators, and activates the behavior analysis layer when any monitoring indicator is abnormal; The behavior analysis layer collects and analyzes process-level behavioral characteristics, outputs a list of suspicious processes and their risk scores, and triggers the essence detection layer when the process risk score exceeds a set threshold; The essence detection layer performs encryption hijacking essence behavior verification on suspicious processes and completes the final decision.

[0012] Preferably, the resource monitoring layer includes a CPU anomaly detection unit, a memory pressure detection unit, and a power consumption deviation detection unit. The detection thresholds of each unit are determined by repeated testing and calibration using historical normal business data, based on the system false alarm rate control requirements. Among them, the threshold of the power consumption deviation detection unit is determined by extensive data verification and optimization, while ensuring that abnormal interference is effectively eliminated.

[0013] Further preferably, the CPU anomaly detection unit identifies steady-state high-load and low-fluctuation patterns of CPU utilization based on time series analysis, specifically:

[0014] Define time window Calculate the average load within the CPU utilization sequence of the time window. Simultaneously calculate the standard deviation of the load. When this occurs, it is determined to be a CPU error.

[0015] In a further preferred embodiment, the memory stress detection unit identifies changes in memory access patterns by monitoring abnormal drops in L3 cache hit rate, specifically implemented as follows:

[0016] First, under normal business conditions, L3 cache hit rates were collected according to CPU load categories, and the median of each category was used as a static baseline. During online detection, the average hit rate is continuously calculated using a sliding window. Then through the formula Calculate the relative rate of change of hit rate, when When this occurs, it is determined to be an abnormal memory pressure.

[0017] In a further preferred embodiment, the power consumption deviation detection unit identifies the high-energy-consumption characteristics of encrypted computing by analyzing abnormal power consumption changes under the same CPU load. Specifically, this is implemented as follows:

[0018] First, a baseline power consumption is obtained based on CPU utilization, frequency, and memory bandwidth, and then a baseline power consumption curve is established.

[0019] Where C represents the CPU load percentage. These are the equipment characteristic parameters obtained by fitting historical data using polynomial regression; then, they are obtained through the formula...

[0020] Calculate the deviation rate between the actual power consumption and the reference power consumption. When the deviation rate... When this occurs, it is determined to be an abnormal deviation in power consumption. In the above formula, This represents the actual power consumption.

[0021] Preferably, the behavior analysis layer includes a feature acquisition engine and a machine learning classifier. The feature acquisition engine uses eBPF technology to capture multi-dimensional behavioral features of processes in real time from the kernel level, such as CPU usage, memory access, process creation, and network connection. The machine learning classifier uses a random forest ensemble learning model to classify process behavior feature vectors in real time by inputting multi-dimensional process behavior feature vectors processed by feature engineering.

[0022] In a further preferred embodiment, the random forest model consists of 100 decision trees. During training, each tree randomly selects 5-dimensional features for feature subsampling and performs bootstrap sampling on the training set with a probability of 0.8 to generate a sub-training set.

[0023] The model uses voting ensemble to obtain a process malice score during prediction. Where T is the number of decision trees. Set a threshold for the predicted label of a single decision tree. ,when It was identified as a Trojan process.

[0024] Preferably, the essence detection layer verifies the hash calculation behavior of suspicious processes through a dangerous operation judge, integrates blockchain network logs and process memory read logs for collaborative analysis, and uses a three-level abstract detection model of FFS feature fragment scanning, HOV hash operation verification, and CBD cryptographic hijacking behavior judgment to complete the final decision.

[0025] The further optimized, three-level abstract detection model makes the following specific judgments:

[0026] FFS uses a recursive greedy matching algorithm to traverse the process memory read instruction sequence, search for string fragments that match known blockchain hash values, and filter out statistically significant fragments with a length greater than or equal to the significance threshold λ.

[0027] HOV verifies the fragments obtained from FFS. If the maximum difference between the fragment index numbers does not exceed the time window ω and the content coverage of the original hash value after sequential concatenation is ≥η=95%, it is determined to be a valid hash read operation.

[0028] After aligning the timestamps of the blockchain network logs and the process memory read logs, CBD counts the number of valid hash read operations within a sliding time window ξ. When the number is greater than or equal to the threshold μ, it is finally confirmed that the process has crypto-hijacking activity. This feature is the judgment logic of the core algorithm process of the essence detection layer.

[0029] The beneficial effects of this invention are as follows:

[0030] This invention constructs a three-tiered detection system encompassing resource monitoring, behavioral analysis, and fundamental verification. By integrating system behavioral characteristics with blockchain network data, it achieves accurate identification and real-time blocking of Trojans. This invention primarily addresses the ineffectiveness of traditional methods against countermeasures such as encrypted communication evasion, code obfuscation, and dynamic frequency modulation. It establishes a fundamental detection mechanism based on unavoidable hardware-level features and blockchain data verification, significantly improving detection accuracy and real-time performance while reducing system overhead and maintenance costs. Detailed Implementation

[0031] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Many specific details are set forth in the following description to provide a thorough understanding of the present invention; however, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0032] This embodiment implements a real-time detection method for multi-dimensional behavioral characteristics analysis of encryption hijacking on the Linux platform. This method relies on a closed-loop governance system formed by the collaborative analysis and processing module and the decision output module. The analysis and processing module executes a three-layer cascaded analysis process consisting of a resource monitoring layer, a behavior analysis layer, and an essence detection layer. The decision output module only performs a response operation after the essence detection layer confirms the encryption hijacking behavior.

[0033] 1. Triggering logic of the overall detection system

[0034] The core of this method is a three-layer cascaded progressive detection, with the triggering conditions for each layer being:

[0035] The resource monitoring layer performs real-time monitoring and initial screening of system-level hardware resource indicators, and outputs system-level risk status indicators. When any monitoring unit detects an anomaly, the behavior analysis layer is immediately activated.

[0036] The behavior analysis layer collects and classifies process-level behavioral characteristics, outputs a list of suspicious processes and their risk scores, and triggers the essence detection layer when the process risk score exceeds the set threshold λ.

[0037] The essence detection layer performs three-level verification of the essential behavior of crypto-hijacking in suspicious processes and makes a final decision. The decision output module initiates a response operation only when the essence detection layer confirms the existence of crypto-hijacking behavior.

[0038] The detection thresholds, calculation models, and algorithm processes at each level are all based on the system's false alarm rate control requirements. They have been repeatedly tested, calibrated, and optimized using historical normal business data to ensure detection accuracy and real-time performance.

[0039] 2. Specific implementation of the resource monitoring layer

[0040] The resource monitoring layer serves as the initial screening layer for cryptographic hijacking detection. It includes a CPU anomaly detection unit, a memory stress detection unit, and a power consumption deviation detection unit. These units perform real-time quantitative detection of system-level CPU, L3 cache, and power consumption metrics, respectively. If any unit detects an anomaly, it triggers the next level of detection. The specific implementation steps of each unit are as follows:

[0041] 2.1 Implementation of CPU Anomaly Detection Unit

[0042] This unit, based on time series analysis, identifies steady-state high-load and low-fluctuation patterns of CPU utilization. Its core is the quantitative analysis of the average CPU load and load standard deviation within a time window. Specific implementation details are as follows:

[0043] Set the time window T = 300s, and define the CPU utilization sequence within this time window as C(t). i (i = 1, 2, ..., N, where N is the number of sampling points);

[0044] Calculate the average load within the time window ,when When the system is determined to be in a high CPU load state, calculate the standard deviation of the CPU load within that time window. ,when At that time, the system is determined to be in a state of low CPU load fluctuation;

[0045] When both of the above conditions are met, the CPU anomaly detection unit determines that the CPU is abnormal.

[0046] 2.2 Implementation of the memory stress detection unit

[0047] This unit identifies changes in memory access patterns caused by malware by monitoring abnormal drops in L3 cache hit rate. The core of this approach involves calculating the relative rate of change in hit rate and determining a threshold, while also implementing a sliding window mechanism to mitigate interference. Specific implementation details are as follows:

[0048] Baseline establishment phase: Under normal business conditions, L3 cache hit rate is collected, and the median of each category is taken as the static baseline H, categorized by CPU load. base This baseline represents the normal cache performance level of the device;

[0049] Real-time monitoring phase: Set the sliding window W=60s, and continuously calculate the current average L3 cache hit rate H within this sliding window. current ;

[0050] Anomaly detection phase: using formulas Calculate the relative rate of change of hit rate, when When the hit rate drops by more than 40%, a memory pressure error message is triggered.

[0051] Anti-interference enhancement mechanism: Continuous confirmation of abnormal results to avoid false alarms caused by instantaneous fluctuations. After continuous confirmation of abnormalities, the memory pressure detection unit determines that the memory pressure is abnormal.

[0052] 2.3 Implementation of the power consumption deviation detection unit

[0053] This unit identifies the high energy consumption characteristics of encrypted computing by analyzing abnormal power consumption changes under the same CPU load. The core of this unit is to establish a baseline power consumption curve and calculate the power consumption deviation rate. Specific implementation details are as follows:

[0054] Establishing a baseline power consumption curve: Under safe device conditions (such as code compilation, video transcoding, etc.), a baseline power consumption is obtained based on indicators such as CPU utilization, frequency, and memory bandwidth to establish a baseline relationship between CPU load and power consumption. Where C represents the CPU load percentage. These are equipment characteristic parameters obtained by fitting historical data through polynomial regression.

[0055] Real-time power consumption calculation: During actual testing, the actual power consumption P of the device under the same CPU load is collected. obs ;

[0056] Anomaly detection phase: using formulas The power consumption deviation rate is calculated. When the deviation rate ΔP > 20%, the power consumption deviation detection unit determines that the power consumption deviation is abnormal. In the above formula, This represents the actual power consumption.

[0057] 2.4 Resource monitoring layer output

[0058] The resource monitoring layer comprehensively judges the results of the three detection units and outputs a system-level risk status indicator: if any unit is determined to be abnormal, the behavior analysis layer is immediately activated; if all units are normal, real-time monitoring is maintained.

[0059] 3. Specific implementation of the behavior analysis layer

[0060] The behavior analysis layer is a process-level screening layer for crypto-hijacking detection. It includes a feature acquisition engine and a machine learning classifier. Based on eBPF technology, it collects multi-dimensional behavioral features of processes and classifies processes through a random forest ensemble learning model to filter out suspicious processes. The specific implementation is divided into two parts: feature engineering strategy and machine learning model design.

[0061] 3.1 Feature Engineering Strategy

[0062] Feature engineering transforms raw data into detectable numerical features, and consists of two steps: raw data acquisition and numerical feature transformation. This ensures that the acquired features accurately reflect the abnormal behavior of the process.

[0063] 3.1.1 Raw Data Acquisition

[0064] Three types of key data are acquired in real time through the system's underlying interfaces, with the collection method and metrics strictly matching the behavioral characteristics at the system kernel level.

[0065] CPU and memory data: Process-level CPU utilization is collected using the kernel performance monitoring interface (perf) (10 samples per second); L3 cache hits and total accesses are counted using the memory performance counter (PMC), where L3 cache hits / total accesses is used to calculate the L3 cache hit rate;

[0066] Process behavior data: Process creation events are tracked through eBPF hooks (fork / clone / execve system calls), recording process parent-child relationships and creation timestamps;

[0067] Network and port data: Capture TCP connection states (such as ESTABLISHED / SYN_SENT / SYN_RECV) through kernel network stack hooks (tcp_connect / tcp_close) and record the port numbers bound to the process.

[0068] 3.1.2 Numerical Feature Transformation

[0069] The collected raw data was transformed into comparable and modelable numerical features, resulting in six core features:

[0070] CPU Unreleased Utilization: Calculates the average CPU utilization within a 60-second sliding window, and simultaneously calculates the standard deviation of the load within the window (reflecting volatility).

[0071] Random I / O percentage: The percentage is calculated by counting the number of random memory accesses initiated by a process within 1 second (determined by the randomness of the vfs_read address) and dividing it by the total number of memory accesses.

[0072] Process creation frequency: Counts the number of new processes created within 1 second (e.g., the number of fork / clone calls);

[0073] Cache hit anomaly: Calculate the difference between the current L3 cache hit rate and the system baseline value ((current hit rate - baseline hit rate) / baseline hit rate); where the current process L3 cache hit rate is obtained by dividing the number of collected L3 cache hits by the total number of accesses, and this current hit rate is used as the input value of x5 in the 8-dimensional feature below;

[0074] TCP state transition features: Statistically calculate the percentage of connections in the ESTABLISHED state within a 10-second window (this percentage is directly used as the input value for x6 in the 8-dimensional features below), and the number of occurrences of the SYN_SENT / SYN_RECV states (combining the total number of these two with the total number of TCP connections within the same window to calculate the TCP new connection rate, which is used as the input value for x7 in the 8-dimensional features below).

[0075] Port context analysis: Records non-standard ports bound to processes (such as 3333 / 5555 / 14444 / 38389, etc.) and associates them with characteristics such as CPU utilization and memory access patterns.

[0076] 3.2 Implementation of Machine Learning Classifier

[0077] This layer uses a random forest ensemble learning model as the core classifier. It classifies suspicious processes through three stages: data preparation, model training, and model prediction. The model parameters are determined after optimization, which effectively solves the problems of high noise and dynamic evolution in cryptographic hijacking detection.

[0078] 3.2.1 Data Preparation Stage

[0079] The input to the random forest model is a multi-dimensional (8 in this example) process behavior feature vector X = [x1, x2, ..., x8] processed by feature engineering, where x1: CPU utilization (%); x2: CPU load volatility (standard deviation); x3: random I / O percentage (%); x4: process creation frequency (times / second); x5: L3 cache hit rate (%); x6: TCP long connection percentage (%); x7: TCP new connection rate (%); x8: non-standard port binding flag (0 / 1).

[0080] The model output is a binary label y∈0,1 indicating whether a sample is a Trojan horse (0 represents normal, 1 represents Trojan horse); based on the collected historical data (including the behavior records of normal processes and Trojan horse processes), the training set Dtrain and the validation set Dval are divided in a 7:3 ratio.

[0081] 3.2.2 Model Training Phase

[0082] The random forest model in this embodiment consists of 100 decision trees. The training process uses feature subsampling and sample subsampling to reduce the risk of overfitting and improve model diversity. Specific steps are as follows:

[0083] Single decision tree generation: Each decision tree is generated by recursively splitting the training data. The splitting criterion is to minimize the Gini coefficient. The maximum depth Dmax=15 (to prevent overfitting due to excessive depth) and the minimum number of subsamples Nmin=10 (minimum number of samples for leaf nodes) are set.

[0084] Feature subsampling: Each tree randomly selects 5 dimensions from the 8-dimensional features as candidate segmentation features. The feature selection probability follows a uniform distribution P(selected feature xi) = 5 / 8 (i = 1, 2, ..., 8), which reduces the interference of noisy features on individual trees.

[0085] Sample subsampling (Bagging): For each tree, a subtraining set D is generated by bootstrapping based on the training set. t For each sample xj in the training set, retain it with probability p=0.8 and retain it with probability p=0.8. Discard the original training set; the size of the sub-training set is basically the same as the original training set.

[0086] Stopping condition: During the decision tree generation process, recursive splitting stops when any of the following conditions are met: the number of samples at the current node. <N min Current node depth = D max All samples in the current node have the same label (pure node);

[0087] Leaf node output: The leaf node finally outputs the majority class label (Trojan / normal) of the sample at that node.

[0088] 3.2.3 Model Prediction Stage

[0089] For the real-time acquired feature samples x of the process to be detected test The final malicious rating is obtained through a voting-based integration process. The specific steps are as follows:

[0090] Single tree prediction: h per tree t For x test Output the predicted labels y∈0,1;

[0091] Voting ensemble: Calculate the average of all decision tree predictions as the process malice score. (T is the number of decision trees; in this example, T=100);

[0092] Threshold determination: Set the threshold τ=0.7 (determined through validation set tuning). When S≥τ, the process is determined to be a suspicious Trojan process.

[0093] 3.3 Behavioral Analysis Layer Output

[0094] The behavior analysis layer outputs a list of suspicious processes and their corresponding risk scores. When a process's risk score exceeds a set threshold τ, the process is marked as a suspicious target and the essence detection layer is triggered. If the risk score does not reach the threshold, it is determined to be a normal process and returned to the resource monitoring layer for continuous monitoring.

[0095] 4. Specific implementation of the essence detection layer

[0096] The essential detection layer is the final adjudication layer for crypto-hijacking detection. Its core is the dangerous operation judge. By integrating the blockchain network log (BL) and the process memory read log (RL), it adopts a three-level abstract detection model of feature fragment scanning (FFS), hash operation verification (HOV), and crypto-hijacking behavior judgment (CBD) to verify the essential crypto-hijacking behavior of suspicious processes and achieve a final adjudication with an extremely low false alarm rate.

[0097] 4.1 Core Data Sources

[0098] This layer's detection is based on two key data sources to ensure accurate capture of hash calculation behavior:

[0099] Blockchain Network Log (BL): A sequence of verified, legitimate block hashes collected by listening to the blockchain network protocol;

[0100] Process Memory Read Log (RL): Collected by the kernel monitoring component (eBPF) for all memory read operations initiated by suspicious processes and fragments of the content they access.

[0101] 4.2 Specific Implementation of the Three-Level Abstract Detection Model

[0102] The three-level detection model is a progressive evidence association model, progressing from micro-level fragment matching to meso-level operational verification, and then to macro-level behavioral arbitration, gradually completing the determination of crypto-hijacking behavior. The algorithm flow and threshold parameters for each stage are as follows:

[0103] 4.2.1 Feature Fragment Scan (FFS)

[0104] The goal of FFS is to efficiently find string fragments that match known blockchain hash values ​​in massive process memory read logs (RL). It employs a recursive greedy matching algorithm, with the following specific steps:

[0105] For a given blockchain hash value H, find the longest consecutive matching substring (LCS) with H in the log RL.

[0106] Set a significance threshold λ=4 characters. If the length of the found LCS |LCS| is less than λ, the match is considered to be statistically insignificant, and further tracking of the substring is abandoned; if |LCS|≥λ, proceed to the next step.

[0107] Using the found LCS as the "anchor point", the given blockchain hash value H is divided into two parts (Hleft and Hright). In the left and right regions of the log position corresponding to the LCS in RL, the first step is repeated to recursively find the longest continuous substring that matches Hleft and Hright.

[0108] Collect all LCS results obtained from recursive searches that meet the significance threshold, sort these LCSs according to their character positions in the original hash H, forming all ordered discrete fragments (s1, s2, s3...) required to reconstruct hash H; at the same time, record the dual position index of each fragment: ① the character position index in the original hash string H (marking which segment of H the fragment corresponds to); ② the log line number / timestamp index in the memory log RL (marking the capture position of the fragment in RL), ensuring that all fragments are as long as possible, do not overlap, and are completely consistent with the order of H.

[0109] 4.2.2 Hash Operation Verification (HOV)

[0110] The goal of HOV is to associate the discrete fragments (s1, s2, s3...) obtained from FFS and determine whether it constitutes a complete hash read operation. This requires simultaneously satisfying two stringent conditions: spatiotemporal proximity and content integrity. Specifically, the determination is as follows:

[0111] Spatiotemporal proximity: Set time window ω=1, the maximum difference in index numbers of all FFS segments that constitute this read in the memory log RL does not exceed ω (i.e., the indices are consecutive or adjacent).

[0112] Content integrity: Set the coverage threshold η=95%. After all FFS fragments are concatenated in the order they appear in the original hash, the content coverage of the original hash value H is ≥η.

[0113] When both conditions are met, it is determined that a chain of evidence proving a single hash read operation has been successfully constructed, thus completing a valid HOV operation.

[0114] 4.2.3 Detection of Cryptographic Hijacking Behavior (CBD)

[0115] The goal of CBD is to ultimately arbitrate persistent crypto-hijacking by detecting high-frequency hash read operations. The core of this approach is the counting of valid HOV operations within a sliding window. Specific steps include:

[0116] Time alignment: Align the block timestamps of the Blockchain Network Log (BL) with the record timestamps of the Process Memory Read Log (RL) to ensure that all analyzed HOV events are within a comparable time frame;

[0117] Sliding window detection: Set the sliding window ξ=2 log recording units, and use this sliding window to count the number of valid HOV operations of suspicious processes in real time;

[0118] Arbitration decision: Set a threshold of μ=9 times. If the number of valid HOV operations counted within any sliding window is ≥μ, then the process is finally confirmed to be carrying out crypto-hijacking activities.

[0119] 4.3, Output of the essential detection layer

[0120] After the essential detection layer completes the three-level verification of the suspicious process, it outputs the final decision result: if the cryptographic hijacking behavior is confirmed, a trigger signal is immediately sent to the decision output module; if the judgment condition is not met, the process is judged to be a normal process, the suspicious mark is removed and the process is returned to the resource monitoring layer.

[0121] 5. Specific implementation of the decision output module

[0122] The decision output module serves as the closed-loop governance terminal for the detection method. It includes a real-time alarm generation unit, a process blocking unit, and a forensic data storage unit. It is activated only after the encryption hijacking behavior is confirmed at the essential detection layer. The specific operations of each unit are as follows:

[0123] Real-time alarm generation unit: Immediately generates security alarms containing abnormal process information, detection indicators, and hash operation verification results, and pushes them to administrators through system preset methods;

[0124] Process blocking unit: Automatically executes malicious process termination operations, cuts off the system resource occupation of Trojan processes, and prevents the continued occurrence of crypto-hijacking behavior;

[0125] Evidence data storage unit: Completely stores all data and detection results from the resource monitoring layer to the essence detection layer, including system resource indicators, process behavior characteristics, hash matching evidence, HOV operation records, etc., forming a complete evidence chain for post-event auditing and analysis.

[0126] 6. Summary of Implementation Examples

[0127] This embodiment achieves real-time, accurate detection and blocking of crypto-hijacking on the Linux platform through a three-tiered cascaded analysis of resource monitoring, behavior analysis, and essence detection layers, combined with closed-loop governance of the decision output module. Specifically, the resource monitoring layer uses quantified hardware indicators to initially screen for system anomalies; the behavior analysis layer uses eBPF feature collection and a random forest model to filter suspicious processes; and the essence detection layer uses collaborative analysis of blockchain data and memory access logs to capture the essential hash calculation behavior of crypto-hijacking. These three layers of detection are progressive and mutually verifying, effectively solving the problems of high false alarm rates, susceptibility to circumvention, and detection lag in traditional detection methods.

[0128] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A Linux platform encryption hijacking real-time detection method based on multi-dimensional behavior characteristics, characterized in that, This method relies on a closed-loop governance system formed by the collaborative analysis and processing module and the decision output module. The analysis and processing module executes a three-layer cascaded analysis process consisting of a resource monitoring layer, a behavior analysis layer, and an essence detection layer. The decision output module executes response operations based on the analysis results of the analysis and processing module. The triggering logic of the three-layer cascaded analysis is as follows: The resource monitoring layer performs real-time monitoring and initial screening of system-level hardware resource indicators, outputs system-level risk status indicators, and activates the behavior analysis layer when any monitoring indicator is abnormal; The behavior analysis layer collects and analyzes process-level behavioral characteristics, outputs a list of suspicious processes and their risk scores, and triggers the essence detection layer when the process risk score exceeds the set threshold. The essential detection layer performs cryptographic hijacking verification on suspicious processes and makes a final decision. The essential detection layer verifies the hash calculation behavior of suspicious processes through a dangerous operation judge, integrates blockchain network logs and process memory read logs for collaborative analysis, and uses a three-level abstract detection model of FFS feature fragment scanning, HOV hash operation verification, and CBD cryptographic hijacking behavior judgment to complete the final decision. The specific determination of the three-level abstract detection model is as follows: FFS uses a recursive greedy matching algorithm to traverse the process memory read instruction sequence, search for string fragments that match known blockchain hash values, and filter out fragments with a length greater than or equal to the significance threshold. HOV verifies the fragments obtained from FFS. If the maximum difference between the fragment index numbers does not exceed the time window ω and the content coverage of the original hash value after sequential concatenation is ≥η=95%, it is determined to be a valid hash read operation. After aligning the timestamps of the blockchain network logs with the process memory read logs, CBD counts the number of valid hash read operations within a sliding time window ξ. When the number is greater than or equal to the threshold μ, it is finally confirmed that the process has engaged in crypto-hijacking activities.

2. The method for real-time detection of Linux platform encryption hijacking based on multi-dimensional behavior characteristics according to claim 1, characterized in that, The resource monitoring layer includes a CPU anomaly detection unit, a memory pressure detection unit, and a power consumption deviation detection unit. The detection thresholds of each unit are determined by repeated testing and calibration based on the system false alarm rate control requirements and historical normal business data. 3.The Linux platform encryption hijacking real-time detection method based on multi-dimensional behavior characteristics according to claim 2, characterized in that, The CPU anomaly detection unit is specifically as follows: Define a time window the CPU occupancy sequence within the time window, calculate the average load within the time window At the same time, calculate the standard deviation of the load When the standard deviation is greater than a predetermined threshold, determine that the CPU is abnormal.

4. The real-time detection method for encryption hijacking on the Linux platform based on multi-dimensional behavioral characteristics according to claim 2, characterized in that, The memory stress detection unit identifies changes in memory access patterns by monitoring abnormal drops in L3 cache hit rate. Specifically, this is implemented as follows: First, under normal business conditions, L3 cache hit rates were collected according to CPU load categories, and the median of each category was used as a static baseline. During online detection, the average hit rate is continuously calculated using a sliding window. Then through the formula Calculate the relative rate of change of hit rate, when When this occurs, it is determined to be an abnormal memory pressure.

5. The real-time detection method for encryption hijacking on the Linux platform based on multi-dimensional behavioral characteristics according to claim 2, characterized in that, The power consumption deviation detection unit analyzes abnormal power consumption changes under the same CPU load, specifically as follows: First, a baseline power consumption is obtained based on CPU utilization, frequency, and memory bandwidth, and then a baseline power consumption curve is established. Where C represents the CPU load percentage. These are the equipment characteristic parameters obtained by fitting historical data using polynomial regression; then, they are obtained through the formula... Calculate the deviation rate between the actual power consumption and the reference power consumption. When the deviation rate... When this occurs, it is determined to be an abnormal deviation in power consumption. In the above formula, This represents the actual power consumption.

6. The real-time detection method for encryption hijacking on the Linux platform based on multi-dimensional behavioral characteristics according to claim 1, characterized in that, The behavior analysis layer includes a feature acquisition engine and a machine learning classifier. The feature acquisition engine, based on eBPF technology, captures multi-dimensional behavioral features of processes in real time from the kernel level, including CPU usage, memory access, process creation, and network connection. The machine learning classifier uses a random forest ensemble learning model, which classifies process behavior feature vectors in real time by inputting multidimensional process behavior feature vectors processed by feature engineering.

7. The real-time detection method for encryption hijacking on the Linux platform based on multi-dimensional behavioral characteristics according to claim 6, characterized in that, The random forest model consists of 100 decision trees. During training, each tree randomly selects 5-dimensional features for feature subsampling and performs bootstrap sampling on the training set with a probability of 0.8 to generate a sub-training set. The model uses voting ensemble to obtain a process malice score during prediction. Where T is the number of decision trees. Set a threshold for the predicted label of a single decision tree. ,when It was identified as a Trojan process.