A Cloud PC Mining Detection Method and System Based on Supervised Classification

Abstract

This disclosure relates to the field of artificial intelligence technology, and in particular provides a cloud PC mining detection method and system based on supervised classification. The method includes collecting system-level resource utilization data of each virtual machine (VM) in a cloud PC cluster within a preset time period; extracting features from the collected system-level and process-level resource utilization data to construct a multi-dimensional feature vector characterizing the behavior patterns of the VMs; the multi-dimensional feature vector includes at least statistical features and fluctuation features of system-level resource utilization, as well as statistical features and fluctuation features of process-level resource utilization; based on the multi-dimensional feature vectors of known mining and normal cloud PC samples, for the VM to be detected, data acquisition and feature engineering steps are performed to obtain its multi-dimensional feature vector, improving the quality and efficiency of detecting illegal VMs and effectively ensuring the adaptability of the optimized method.

Description

Technical Field

[0001] This disclosure relates to the technical field of cloud computing, and in particular to a cloud computer mining detection method and system based on supervised classification. Background Technology

[0002] With the rapid development of cloud computing technology, cloud PCs (also known as cloud desktops) have been widely adopted by individual and enterprise users due to their flexibility, convenience, and cost-effectiveness. However, the popularity of cloud PCs has also brought new security challenges, among which the use of cloud PCs for illegal cryptocurrency mining (referred to as "mining") is becoming increasingly rampant. Mining not only consumes a large amount of cloud service providers' computing resources, network bandwidth, and electricity, leading to a decline in service quality and a surge in operating costs, but also may bring legal risks and security vulnerabilities.

[0003] Existing technology 1: CN117454372A can use the violation detection model trained on the violation operation interface to detect the interface displayed on the cloud computer, so as to determine whether the interface displayed on the cloud computer includes the content corresponding to the violation operation, thus solving the problem of poor reliability of the detection results of violation operations on the cloud computer.

[0004] Existing technology 2: CN117997611A The traffic data to be detected corresponding to the cloud platform, feature extraction is performed on the above traffic data to be detected, and deep learning is used to identify mining traffic using three traffic categories: traffic size category, traffic time category, and traffic content category.

[0005] Existing technology 3: CN116032618A obtains the current resource status change value of the host under test; if the current resource status change value is greater than the first threshold, the host under test is subjected to anomaly judgment processing; if the current resource status change value corresponding to any unknown process is greater than the second threshold, it is determined that there is mining behavior in the host under test.

[0006] Existing methods for detecting cryptocurrency mining on cloud PCs mainly include traffic detection, load monitoring, and process detection. However, traffic detection is currently subject to interference from technologies such as data encryption and proxy forwarding, resulting in low accuracy. Load monitoring technology faces the challenge of mining users actively controlling the load, making it difficult to quickly distinguish mining desktops from those of ordinary users based on cloud PC load. Process detection is inefficient in identifying mining users' attempts to disguise mining processes.

[0007] To address the aforementioned issues, this proposal suggests a cloud computing mining detection method based on supervised classification, which improves upon the main shortcomings of existing technologies and solves the following key problems: The load change rate index is used to extract virtual machine load and process load for comprehensive analysis, which solves the problem that traditional methods for extracting high-load desktops are not easy to distinguish between mining desktops and normal desktops. Based on the characteristics of process distribution, further optimize the process detection to address the problem of being easily deceived by tampering with process names.

[0008] In view of the shortcomings of the prior art, this disclosure provides and apparatus. Summary of the Invention

[0009] To achieve the above objectives, the present disclosure adopts the following technical solution: One aspect of this disclosure provides a cloud computer mining detection method based on supervised classification, comprising the following steps: Collect system-level resource utilization data of each virtual machine in the cloud computer cluster within a preset time period, as well as process-level resource utilization data of the processes running within the virtual machines. Feature extraction is performed on the collected system-level resource utilization data and process-level resource utilization data to construct a multi-dimensional feature vector to characterize the behavior pattern of cloud computer virtual machines; the multi-dimensional feature vector includes at least the statistical features and fluctuation features of the system-level resource utilization, as well as the statistical features and fluctuation features of the process-level resource utilization. Based on the multidimensional feature vectors of known mining cloud computer samples and normal cloud computer samples, a supervised classification model is constructed. For the cloud computer virtual machine to be detected, the data acquisition step and feature engineering step are performed to obtain its multidimensional feature vector, and the multidimensional feature vector is input into the supervised classification model and the probability or classification result of the cloud computer virtual machine to be detected being a mining virtual machine is output. Based on the output of the supervised classification model, the detection result of whether the cloud computer virtual machine to be detected is engaged in mining behavior is determined and output.

[0010] In one optional implementation, the system-level resource utilization data includes, but is not limited to, at least one of CPU utilization, memory utilization, and network I / O rate; the statistical characteristics of the system-level resource utilization include the mean, median, or peak value of the corresponding resource utilization within the preset time period; the fluctuation characteristics of the system-level resource utilization include the standard deviation, variance, coefficient of variation, or range of the corresponding resource utilization within the preset time period.

[0011] In one optional implementation, the multidimensional feature vector further includes process distribution features, which at least include: statistical and fluctuation features of the process-level resource utilization of the top N processes in terms of resource occupancy within the cloud computer virtual machine, where N is a preset positive integer and / or the number of processes in the cloud computer virtual machine whose resource occupancy exceeds a preset threshold and their proportion to the total number of processes.

[0012] In an optional implementation, the method further includes filtering out abnormal virtual machines suspected of potential mining from the cloud computer cluster based on preset system-level resource utilization thresholds and system-level resource utilization fluctuation thresholds; the data collection steps for process-level resource utilization data, as well as the subsequent feature engineering steps, supervised classification model construction and training steps, and mining behavior detection steps, are only performed on the abnormal virtual machines.

[0013] In one optional implementation, when the statistical characteristics of the system-level resource utilization of the cloud computer virtual machine are higher than the corresponding preset high threshold, and the fluctuation characteristics of the system-level resource utilization are lower than the corresponding preset low threshold, the cloud computer virtual machine is determined to be the abnormal virtual machine.

[0014] In one optional implementation, the process-level resource utilization data includes, but is not limited to, at least one of the following: CPU utilization, memory utilization, and network I / O rate of each process; the statistical characteristics of the process-level resource utilization include the mean, median, or peak value of the corresponding process resource utilization within the preset time period; and the fluctuation characteristics of the process-level resource utilization include the standard deviation, variance, coefficient of variation, or range of the corresponding process resource utilization within the preset time period.

[0015] In one optional implementation, the model further includes an iterative optimization step: periodically collecting new mining cloud computer samples and normal cloud computer samples, or manually reviewing and confirming the detection results output by the mining behavior detection step, adding the confirmed samples to the training set, and retraining or incrementally training the supervised classification model to optimize the model detection performance.

[0016] Another aspect of this disclosure provides a cloud-based cryptocurrency mining detection system based on a supervised classification method, comprising: The data acquisition module is used to collect system-level resource utilization data of each cloud computer virtual machine in the cloud computer cluster within a preset time period, as well as process-level resource utilization data of the processes running within the cloud computer virtual machines. The feature engineering module is used to extract features from the collected system-level resource utilization data and process-level resource utilization data, and construct a multi-dimensional feature vector to characterize the behavior pattern of cloud computer virtual machines; the multi-dimensional feature vector includes at least the statistical features and fluctuation features of system-level resource utilization, as well as the statistical features and fluctuation features of process-level resource utilization. The model building and training module constructs a supervised classification model based on the multidimensional feature vectors of known mining cloud computer samples and normal cloud computer samples, and trains the supervised classification model using the samples to learn the behavioral pattern features of mining cloud computers. The detection module calls the data acquisition module and the feature engineering module to obtain the multi-dimensional feature vector of the cloud computer virtual machine to be detected, and inputs the multi-dimensional feature vector into the trained supervised classification model. The supervised classification model outputs the probability or classification result that the cloud computer virtual machine to be detected is a mining virtual machine. The result output module determines and outputs the detection result of whether the cloud computer virtual machine to be detected is engaged in mining behavior based on the output result of the supervised classification model.

[0017] In another aspect of this disclosure, an electronic device is provided, comprising: At least one memory stores computer-executable instructions non-transiently; At least one processor, configured to run the computer-executable instructions, The computer-executable instructions are executed by the processor to implement the cloud computer mining detection method based on supervised classification described above.

[0018] In another aspect, this disclosure provides a computer-readable storage medium storing computer-executable instructions that, when executed by at least one processor, implement the cloud computer mining detection method based on supervised classification described above.

[0019] This disclosure collects system-level resource utilization data of each virtual machine (VM) in a cloud computer cluster within a preset time period; extracts features from the collected system-level and process-level resource utilization data to construct a multi-dimensional feature vector characterizing the behavior patterns of the VMs; the multi-dimensional feature vector includes at least the statistical and fluctuation features of system-level resource utilization, as well as the statistical and fluctuation features of process-level resource utilization; based on the multi-dimensional feature vectors of known mining VM samples and normal VM samples, for the VM to be detected, data acquisition and feature engineering steps are performed to obtain its multi-dimensional feature vector, proposing a mining VM detection method based on supervised classification. This avoids the problem of low accuracy in identifying illegal VMs due to process tampering, improves the quality and efficiency of illegal VM detection, effectively ensures the adaptability of the optimized method, and has good commercial value. Attached Figure Description

[0020] The accompanying drawings are provided to further illustrate the present disclosure and form part of the specification. They are used together with the embodiments of the present disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a cloud computer mining detection method based on supervised classification provided in Embodiment 1 of this disclosure; Figure 2 This is the framework of a cloud computer mining detection system based on a supervised classification method provided in Embodiment 3 of this disclosure; Figure 3 This is a block diagram of the electronic device provided in Embodiment 4 of this disclosure; Figure 4 This is a block diagram of a computer-readable storage medium provided in Embodiment 4 of this disclosure. Detailed Implementation

[0021] The technical solutions of the present disclosure will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments.

[0022] In the following description, the terms "first," "second," etc., are used for descriptive convenience only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this disclosure, unless otherwise stated, "a plurality of" means two or more.

[0023] In this disclosure, unless otherwise expressly specified and limited, the term "connection" should be interpreted broadly. For example, "connection" can be a fixed mechanical connection, a detachable mechanical connection, or an integral part; or, "connection" can be a direct connection or an indirect connection through an intermediate medium. Furthermore, unless otherwise expressly specified and limited, the term "coupling" should be interpreted broadly. For example, "coupling" can be a direct electrical connection, such as physical contact and electrical conduction between two components; it can also be understood as an electrical connection between different components in a circuit structure through physical lines capable of transmitting electrical signals, such as copper foil or wires on a printed circuit board (PCB), to transmit electrical signals; or, "coupling" can be an indirect electrical connection between two components through an intermediate medium; or, "coupling" can be an electrical connection between two components in a non-contact manner, such as an electrical connection between two components using capacitive coupling to transmit electrical signals.

[0024] In this embodiment of the disclosure, directional terms such as "up," "down," "left," and "right" may be defined relative to the orientation in which the components are schematically placed in the accompanying drawings. It should be understood that these directional terms can be relative concepts, used for relative description and clarification, and can change accordingly depending on the orientation in which the components are placed in the accompanying drawings.

[0025] Example 1: like Figure 1As shown, this disclosure provides a cloud computer mining detection method based on supervised classification, comprising the following steps: Step S100: Collect system-level resource utilization data of each cloud computer virtual machine in the cloud computer cluster within a preset time period, as well as process-level resource utilization data of the processes running within the cloud computer virtual machines; Step S200: Extract features from the collected system-level resource utilization data and process-level resource utilization data to construct a multi-dimensional feature vector characterizing the behavior pattern of cloud computer virtual machines; the multi-dimensional feature vector includes at least the statistical features and fluctuation features of the system-level resource utilization, as well as the statistical features and fluctuation features of the process-level resource utilization. Step S300: Based on the multidimensional feature vectors of known mining cloud computer samples and normal cloud computer samples, construct a supervised classification model; Step S400: For the cloud computer virtual machine to be detected, perform the data acquisition step and feature engineering step to obtain its multidimensional feature vector, and input the multidimensional feature vector into the supervised classification model and output the probability or classification result of the cloud computer virtual machine to be detected as a mining virtual machine; Step S500: Based on the output of the supervised classification model, determine and output the detection result of whether the cloud computer virtual machine to be detected is engaged in mining behavior.

[0026] In the above embodiments, the load change rate index is used to extract virtual machine load and process load for comprehensive judgment, which solves the defect of traditional methods for extracting high-load desktops that are not easy to distinguish between mining desktops and normal desktops; based on the process distribution characteristics, the problem of process detection being easily deceived by tampered process names is further optimized.

[0027] Example 2: like Figure 1 As shown, based on Embodiment 1, the steps provided in this disclosure embodiment include the system-level resource utilization data, including but not limited to at least one of CPU utilization, memory utilization, and network I / O rate; the statistical characteristics of the system-level resource utilization include the mean, median, or peak value of the corresponding resource utilization within the preset time period; the fluctuation characteristics of the system-level resource utilization include the standard deviation, variance, coefficient of variation, or range of the corresponding resource utilization within the preset time period.

[0028] Specifically, the multidimensional feature vector also includes process distribution features, which at least include: statistical and fluctuation features of the process-level resource utilization of the top N processes in terms of resource occupancy within the cloud computer virtual machine, where N is a preset positive integer and / or the number of processes in the cloud computer virtual machine whose resource occupancy exceeds a preset threshold and their proportion to the total number of processes.

[0029] Specifically, it also includes filtering out abnormal virtual machines suspected of potential mining from the cloud computer cluster based on preset system-level resource utilization thresholds and system-level resource utilization fluctuation thresholds; the data collection steps for process-level resource utilization data, as well as the subsequent feature engineering steps, supervised classification model construction and training steps, and mining behavior detection steps, are only executed for the abnormal virtual machines.

[0030] Specifically, when the statistical characteristics of the system-level resource utilization of a cloud computer virtual machine are higher than the corresponding preset high threshold, and the fluctuation characteristics of the system-level resource utilization are lower than the corresponding preset low threshold, the cloud computer virtual machine is determined to be an abnormal virtual machine.

[0031] Specifically, the process-level resource utilization data includes, but is not limited to, at least one of the following: CPU utilization, memory utilization, and network I / O rate for each process; the statistical characteristics of the process-level resource utilization include the mean, median, or peak value of the corresponding process resource utilization within the preset time period; and the fluctuation characteristics of the process-level resource utilization include the standard deviation, variance, coefficient of variation, or range of the corresponding process resource utilization within the preset time period.

[0032] Specifically, it also includes model iteration and optimization steps: periodically collecting new mining cloud computer samples and normal cloud computer samples, or manually reviewing and confirming the detection results output by the mining behavior detection step, adding the confirmed samples to the training set, and retraining or incrementally training the supervised classification model to optimize the model detection performance.

[0033] In the above embodiments, the "abnormal virtual machine load detection method" is first used to detect virtual machines with abnormal load behavior; then, the virtual machines with abnormal load behavior are further filtered out by "abnormal process detection".

[0034] The monitoring platform collects information on the CPU, memory, and network usage of cloud virtual machines (VMs) over a period of time. A set U = {CPUmean, MEMmean, INTERNETmean, CPUcr, MEMcr, INTERNETcr} is used to record the load characteristics of the cloud VMs. Here, CPUmean, MEMmean, and INTERNETmean represent the average CPU, memory, and network utilization of the cloud VMs over a period T, respectively. CPUcr, MEMcr, and INTERNETcr represent the standard deviations of the average utilization over each equal time interval t within time T. Taking CPUcr as an example: CPUcr=2i=1i=nCPUmeanti CPUmean2 / n When cloud computers are used for mining, the virtual machine load generally has two characteristics: high load and low load change rate. Based on these two characteristics, this proposal suggests a method to identify abnormal load virtual machines based on the resource utilization rate of cloud computer virtual machines. The abnormal load cloud computers that are quickly screened out have a high probability of being mining cloud computers.

[0035] Using the proposed metrics, a series of thresholds U_td={CPUmean_td,MEMmean_td,INTERNETmean_td,CPUcr_td,MEMcr_td,INTERNETcr_td} are confirmed based on the known cloud computing load characteristics. When a cloud computing load characteristic UC={CPUmeanuc,MEMmeanuc,INTERNETmeanuc,CPUcruc,MEMcruc,INTERNETcruc} meets the following conditions, it can be identified as an abnormal virtual machine: CPUmeanuc>CPUmean_td MEMmeanuc>MEMmean_td INTERNETmeanuc>INTERNETmean_td CPUcruc <CPUcr_td MEMmeanuc <MEMmean_td INTERNETmeanuc <INTERNETmean_td Step 2 identifies abnormal cloud virtual machines and obtains the process list and resource usage information within the virtual machine. Let the process set be VM={P1, P2, P3......Pn}. Pn = {"Process Name", PCPUmean, PMEMmean, PINTERNETmean, PCPUcr, ...} PMEMcr, PINTERNETcr}, where PCPUmean, PMEMmean, and PINTERNETmean are the average CPU, memory, and network utilization rates of the process over a period of time T, respectively, and PCPUcr, PMEMcr, and PINTERNETcr are the standard deviations of the average utilization rates of the process over each equal time period t within time T. The calculation method is the same as the calculation method for virtual machine response indicators in synchronous cloud computers.

[0036] The resource utilization of processes within the VM set is statistically analyzed. Processes with CPU, memory, and network resource utilization exceeding set thresholds and with a standard deviation less than the set thresholds are defined as abnormal processes. Detected abnormal processes undergo secondary manual identification to determine if they are involved in illegal mining. VMs exhibiting mining activities are then flagged as mining VMs for subsequent monitoring and classification.

[0037] Based on the mining virtual machines obtained in step 4, similar virtual machines with the same virtual machine characteristics and process characteristics are retrieved, and all retrieved similar virtual machines are marked as mining virtual machines. The virtual machine characteristics are: load and standard deviation of various indicators, and the process characteristics are the load and standard deviation of various indicators of the top 3 processes with the highest CPU utilization.

[0038] System-level resource utilization data of each virtual machine (VM) in the cloud computer cluster is collected from the cloud computer management platform or related monitoring system within a preset time period T (e.g., T=24 hours, which can be adjusted according to actual conditions). The system-level resource utilization data includes at least CPU utilization, memory (MEM) utilization, and network (INTERNET) I / O rate.

[0039] For each cloud virtual machine, based on the collected raw resource utilization data, its load characteristics are extracted to form a load characteristic set U. The load characteristic set U is defined as follows: U={CPUmean,MEMmean,INTERNETmean,CPUcr,MEMcr,INTERNETcr} in: CPUmean: Represents the average CPU utilization of the cloud computer virtual machine within the time period T.

[0040] MEMmean: Represents the average memory utilization of the cloud virtual machine within the time period T.

[0041] INTERNETmean: Represents the average network I / O rate of the cloud computer virtual machine during the time period T (which can be expressed as average bandwidth utilization or average traffic).

[0042] CPUcr: Represents the rate of change of CPU utilization. Specifically, within a time period T, T is divided into n equal-length sub-time periods t (e.g., t = 5 minutes, n = T / t = 288). The average CPU utilization CPUmeanti within each sub-time period t is calculated. Then, the average of the squares of the differences between these n CPUmeanti and CPUmean is calculated, and the square root is taken (i.e., the standard deviation). The formula is as follows: CPUcr = sqrt((Σ(CPUmeanti-CPUmean)^2) / n), where i ranges from 1 to n.

[0043] The calculation methods for MEMcr and INTERNETcr are similar to those for CPUcr, based on average memory utilization and average network I / O rate, respectively.

[0044] Step S102: Preliminary screening of abnormal virtual machines based on virtual machine load characteristics Cloud PC mining behavior typically exhibits a specific load pattern: high resource utilization and low resource utilization fluctuations. Based on this, this step aims to quickly identify abnormal virtual machines suspected of potential mining by judging the load characteristics of virtual machines through preset thresholds.

[0045] A predefined set of abnormal load judgment thresholds, U_td, is defined as follows: U_td = {CPUmean_td, MEMmean_td, INTERNETmean_td, CPUcr_td, MEMcr_td, INTERNETcr_td}. Where: CPUmean_td, MEMmean_td, and INTERNETmean_td are the high thresholds for average CPU, memory, and network utilization, respectively.

[0046] CPUcr_td, MEMcr_td, and INTERNETcr_td are the low thresholds for the rate of change (standard deviation) of CPU, memory, and network utilization, respectively.

[0047] For any cloud virtual machine (VM), its load characteristic set is UC = {CPUmeanuc, MEMmeanuc, INTERNETmeanuc, CPUcruc, MEMcruc, INTERNETcruc}. A VM is considered abnormal when its UC meets all of the following conditions: CPUmeanuc>CPUmean_td MEMmeanuc>MEMmean_td INTERNETmeanuc>INTERNETmean_td CPUcruc <CPUcr_td MEMcruc <MEMcr_tdINTERNETcruc<INTERNETcr_td These thresholds U_td can be set based on statistical analysis of the load characteristics of historical normal virtual machines and known mining virtual machines, and can be dynamically adjusted according to actual operating conditions.

[0048] Step S103: Data collection and feature extraction of process load within abnormal virtual machines For the abnormal virtual machines screened out in step S102, further delve into their internal structure and collect process-level resource utilization data of all processes running on the virtual machine within a preset time period T (the same as or adjustable from step S101).

[0049] Let the set of processes within the abnormal virtual machine be VM={P1,P2,P3,…,Pn}, where n is the number of processes. For each process Pi (i=1,2,…,n) in the set, extract its process load characteristics to form a process feature set Pi: Pi = {"Process Name", PCPUmean, PMEMmean, PINTERNETmean, PCPUcr, PMEMcr, PINTERNETcr} in: "Process Name": The name of the executable file or display name of this process.

[0050] PCPUmean: Represents the average CPU utilization of process Pi within time period T.

[0051] PMEMmean: Represents the average memory usage of process Pi within time period T.

[0052] PINTERNETmean: Represents the average network I / O rate of process Pi within time period T.

[0053] PCPUcr: Represents the CPU utilization rate change index of process Pi. The calculation method is similar to CPUcr in step S101, based on the average CPU utilization PCPUmeanti of process Pi over n sub-time periods t.

[0054] The calculation methods for PMEMcr and PINTERNETcr are similar to those for PCPUcr, based on the average memory usage of a process and the average network I / O rate, respectively.

[0055] Step S104: Abnormal process detection and mining virtual machine marking based on process load characteristics The process load characteristics of all processes in the process set VM are statistically analyzed. A set of preset process-level resource utilization thresholds P_td is defined (e.g., PCPUmean_td, PMEMmean_td, PINTERNETmean_td, PCPUcr_td, PMEMcr_td, PINTERNETcr_td).

[0056] For process Pi, it is marked as an abnormal process if it meets at least one (or a combination of more, configurable) of the following conditions: PCPUmean > PCPUmean_td and PCPUcr <PCPUcr_td; and / or PMEMmean > PMEMmean_td and PMEMcr <PMEMcr_td; and / or PINTERNETmean > PINTERNETmean_td and PINTERNETcr <PINTERNETcr_td。

[0057] Detected abnormal processes will be submitted to security management personnel for secondary manual identification and analysis to determine whether they are genuine illegal mining processes (e.g., by checking process paths, digital signatures, behavioral analysis, etc.). If at least one mining process is identified in an abnormal virtual machine, that abnormal virtual machine will be marked as a "mining virtual machine." These manually confirmed mining virtual machines, along with their load characteristics and process characteristics, will serve as important sample data for subsequent training of supervised classification models.

[0058] Step S105: Supervised classification model training and mining behavior detection based on labeled samples Using the manually labeled "mining virtual machine" samples from step S104, and the known normal cloud computer virtual machine samples selected from the cloud computer cluster (labeled as "normal virtual machines"), a training dataset for the supervised classification model is constructed.

[0059] Feature selection: For each sample virtual machine (mining or normal), its feature vector may include: Virtual machine level features: namely, the various indicators (CPUmean, MEMmean, INTERNETmean, CPUcr, MEMcr, INTERNETcr) extracted from the U set in step S101.

[0060] Process-level characteristics: For example, the metrics (PCPUmean, PMEMmean, PINTERNETmean, PCPUcr, PMEMcr, PINTERNETcr) of the Pi set of the processes with the highest CPU utilization (e.g., K=3) within the virtual machine. If the number of processes is less than K, all processes are included. These TOPK processes are usually the main consumers of system resources and are crucial for determining whether mining is underway.

[0061] Model Training: The constructed feature vectors and their corresponding labels ("mining virtual machine" or "normal virtual machine") are input into a selected supervised classification algorithm for model training. The supervised classification algorithm can be, but is not limited to, Support Vector Machine (SVM), Random Forest, Gradient Boosting Decision Tree (GBDT), Logistic Regression, or a neural network. Through training, the model learns the decision boundaries that distinguish between mining virtual machines and normal virtual machines.

[0062] Model Application and Mining Detection: For cloud computer virtual machines (VMs) in an unknown state that need to be detected within a cloud computer cluster, execute steps S101 (VM load feature extraction) and S103 (if necessary for preliminary judgment, or as part of the regular process, extract its process features) to construct a feature vector consistent with the training sample format, and then input it into the trained supervised classification model. The model will output the probability that the VM belongs to a "mining VM" or a direct classification result.

[0063] Model Iteration and Optimization: As new mining samples and normal samples accumulate (e.g., by manually reviewing new detection results), the supervised classification model is periodically retrained or incrementally trained using updated datasets to continuously optimize the model's detection performance and generalization ability, adapting to new mining methods and changes.

[0064] Example 3: like Figure 2 As shown, based on Embodiment 1, this disclosure provides a cloud computer mining detection system based on a supervised classification method, including: The data acquisition module is used to collect system-level resource utilization data of each cloud computer virtual machine in the cloud computer cluster within a preset time period, as well as process-level resource utilization data of the processes running within the cloud computer virtual machines. The feature engineering module is used to extract features from the collected system-level resource utilization data and process-level resource utilization data, and construct a multi-dimensional feature vector to characterize the behavior pattern of cloud computer virtual machines; the multi-dimensional feature vector includes at least the statistical features and fluctuation features of system-level resource utilization, as well as the statistical features and fluctuation features of process-level resource utilization. The model building and training module constructs a supervised classification model based on the multidimensional feature vectors of known mining cloud computer samples and normal cloud computer samples, and trains the supervised classification model using the samples to learn the behavioral pattern features of mining cloud computers. The detection module calls the data acquisition module and the feature engineering module to obtain the multi-dimensional feature vector of the cloud computer virtual machine to be detected, and inputs the multi-dimensional feature vector into the trained supervised classification model. The supervised classification model outputs the probability or classification result that the cloud computer virtual machine to be detected is a mining virtual machine. The result output module determines and outputs the detection result of whether the cloud computer virtual machine to be detected is engaged in mining behavior based on the output result of the supervised classification model.

[0065] Example 4: Figure 3 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown.

[0066] The electronic device may include a central processing unit / microprocessor / main control chip, etc. 4; and a storage medium 5, coupled to the central processing unit / microprocessor / main control chip, etc. 4, and storing computer-executable instructions therein for performing the steps of the various methods of the embodiments of this disclosure when executed by the processor.

[0067] The central processing unit / microprocessor / main control chip, etc., can include, but are not limited to, one or more processors or microprocessors.

[0068] Storage medium 5 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, computer storage media (e.g., hard disk, floppy disk, solid-state drive, removable disk, CD-ROM, DVD-ROM, Blu-ray disc, etc.).

[0069] In addition, the electronic device may also include (but is not limited to) a data bus 6, an input / output bus / external bus / device bus 7, a display 8, and input / output devices 9 (e.g., keyboard, mouse, speaker, etc.).

[0070] The central processing unit / microprocessor / main control chip, etc. 4 can communicate with external devices (8, 9, etc.) via I / O bus 7 through wired or wireless network (not shown).

[0071] The storage medium 5 may also store at least one computer-executable instruction for performing the steps of various functions and / or methods in the embodiments described herein when the central processing unit / microprocessor / main control chip, etc., 4 is running.

[0072] In one embodiment, the at least one computer-executable instruction may also be compiled into or comprise a software product, wherein one or more computer-executable instructions are executed by a processor to perform the steps of the various functions and / or methods in the embodiments described herein.

[0073] Figure 4 A schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure is shown.

[0074] like Figure 4As shown, the non-transitory computer-readable storage medium 11 stores instructions, such as computer-readable instructions 10. When the computer-readable instructions 10 are executed by a processor, the various methods described above can be performed. The non-transitory computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-transitory non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. For example, the non-transitory computer-readable storage medium 11 can be connected to a computing device such as a computer, and then, when the computing device executes the computer-readable instructions 10 stored on the computer-readable storage medium 11, the various methods described above can be performed.

[0075] In the several embodiments provided in this disclosure, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0076] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0077] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0078] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for executing all or part of the steps of the methods of the various embodiments of this disclosure through a computer device (which may be a personal computer, server, or network device, etc.). The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0079] The above embodiments are only used to illustrate the technical solutions of this disclosure, and are not intended to limit it. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure.

Claims

1. A cloud computing mining detection method based on supervised classification, characterized in that, include: Collect system-level resource utilization data of each virtual machine in the cloud computer cluster within a preset time period, as well as process-level resource utilization data of the processes running within the virtual machines. Feature extraction is performed on the collected system-level resource utilization data and process-level resource utilization data to construct a multi-dimensional feature vector to characterize the behavior pattern of cloud computer virtual machines. The multidimensional feature vector includes at least the statistical features of the system-level resource utilization rate and the fluctuation features of the system-level resource utilization rate, as well as the statistical features of the process-level resource utilization rate and the fluctuation features of the process-level resource utilization rate. Based on the multidimensional feature vectors of known mining cloud computer samples and normal cloud computer samples, a supervised classification model is constructed. For the cloud computer virtual machine to be detected, the data acquisition step and feature engineering step are performed to obtain its multidimensional feature vector, and the multidimensional feature vector is input into the supervised classification model and the probability or classification result of the cloud computer virtual machine to be detected being a mining virtual machine is output. Based on the output of the supervised classification model, the detection result of whether the cloud computer virtual machine to be detected is engaged in mining behavior is determined and output.

2. The cloud computing mining detection method based on supervised classification as described in claim 1, characterized in that, The resource utilization data includes, but is not limited to, at least one of CPU utilization, memory utilization, and network I / O rate; the statistical characteristics of the system-level resource utilization include the mean, median, or peak value of the corresponding resource utilization within the preset time period; the fluctuation characteristics of the system-level resource utilization include the standard deviation, variance, coefficient of variation, or range of the corresponding resource utilization within the preset time period.

3. The cloud computing mining detection method based on supervised classification as described in claim 1, characterized in that, The multidimensional feature vector also includes process distribution features, which at least include: statistical and fluctuation features of the process-level resource utilization of the top N processes in terms of resource occupancy rate in the cloud computer virtual machine, where N is a preset positive integer and / or the number of processes in the cloud computer virtual machine whose resource occupancy rate exceeds a preset threshold and their proportion to the total number of processes.

4. The cloud computer mining detection method based on supervised classification as described in claim 1, characterized in that, It also includes filtering out abnormal virtual machines with potential mining suspicions from the cloud computer cluster based on preset system-level resource utilization thresholds and system-level resource utilization fluctuation thresholds; the data collection steps for process-level resource utilization data, as well as the subsequent feature engineering steps, supervised classification model construction and training steps, and mining behavior detection steps, are only executed for the abnormal virtual machines.

5. The cloud computing mining detection method based on supervised classification as described in claim 4, characterized in that, When the statistical characteristics of the system-level resource utilization of a cloud computer virtual machine are higher than the corresponding preset high threshold, and the fluctuation characteristics of the system-level resource utilization are lower than the corresponding preset low threshold, the cloud computer virtual machine is determined to be an abnormal virtual machine.

6. The cloud computing mining detection method based on supervised classification as described in claim 1, characterized in that, The process-level resource utilization data includes, but is not limited to, at least one of the following: CPU utilization, memory utilization, and network I / O rate for each process; the statistical characteristics of the process-level resource utilization include the mean, median, or peak value of the corresponding process resource utilization within the preset time period; the fluctuation characteristics of the process-level resource utilization include the standard deviation, variance, coefficient of variation, or range of the corresponding process resource utilization within the preset time period.

7. The cloud computer mining detection method based on supervised classification as described in claim 1, characterized in that, It also includes model iteration and optimization steps: periodically collecting new mining cloud computer samples and normal cloud computer samples, or manually reviewing and confirming the detection results output by the mining behavior detection step, adding the confirmed samples to the training set, and retraining or incrementally training the supervised classification model to optimize the model detection performance.

8. A cloud PC mining detection system based on a supervised classification method, as described in any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to collect system-level resource utilization data of each cloud computer virtual machine in the cloud computer cluster within a preset time period, as well as process-level resource utilization data of the processes running within the cloud computer virtual machines. The feature engineering module is used to extract features from the collected system-level resource utilization data and process-level resource utilization data, and construct a multi-dimensional feature vector to characterize the behavior pattern of cloud computer virtual machines; the multi-dimensional feature vector includes at least the statistical features and fluctuation features of system-level resource utilization, as well as the statistical features and fluctuation features of process-level resource utilization. The model building and training module constructs a supervised classification model based on the multidimensional feature vectors of known mining cloud computer samples and normal cloud computer samples, and trains the supervised classification model using the samples to learn the behavioral pattern features of mining cloud computers. The detection module calls the data acquisition module and the feature engineering module to obtain the multi-dimensional feature vector of the cloud computer virtual machine to be detected, and inputs the multi-dimensional feature vector into the trained supervised classification model. The supervised classification model outputs the probability or classification result that the cloud computer virtual machine to be detected is a mining virtual machine. The result output module determines and outputs the detection result of whether the cloud computer virtual machine to be detected is engaged in mining behavior based on the output result of the supervised classification model.

9. An electronic device, comprising: At least one memory stores computer-executable instructions non-transiently; At least one processor, configured to run the computer-executable instructions, The computer-executable instructions are implemented by the processor at runtime according to any one of claims 1-7, which describes a cloud computer mining detection method based on a supervised classification method.

10. A computer-readable storage medium, wherein, The computer-readable storage medium stores computer-executable instructions, which, when executed by at least one processor, implement a cloud computer mining detection method based on a supervised classification method according to any one of claims 1-7.

Images