A graphics card mining detection method and device based on a physical layer signal

Abstract

The application discloses a graphics card mining behavior detection method and device based on a physical layer signal. The input current signal of a protected graphics card is monitored; the input current signal of the graphics card is analog-digital converted to obtain a current signal to be detected; the current signal to be detected is tested through a current absolute value, a current variance and a specific response frequency, the current absolute value, the current variance and the specific response frequency are all provided with corresponding test conditions, if more than one of the current absolute value, the current variance and the specific response frequency meets the corresponding test condition, the graphics card is a non-mining module, and if the current absolute value, the current variance and the specific response frequency all do not meet the corresponding test condition, the graphics card is a mining module output. The system can be deployed on a host with a graphics card to perform real-time dynamic monitoring, and the system can also store results to perform periodic offline monitoring.

Description

TECHNICAL FIELD

[0001] The present application relates to mining behavior recognition, in particular, to a graphics card mining behavior detection method and device based on physical layer signals. BACKGROUND

[0002] Blockchain is a secure shared decentralized data ledger. In order to share data among various participants, the blockchain system needs each node to use the same consensus algorithm to maintain the consistency of each node. Proof of work is a very typical and commonly used consensus algorithm. The participating nodes confirm the transactions occurring in the blockchain system within a period of time by contributing computing power, and record them on the blockchain to form a new block. This process is called mining.

[0003] Mining hijacking is a new type of network crime based on mining. The main content is to use the computing power of the user's computing device to mine without the user's consent, and the income goes into his own pocket. In recent years, mining hijacking has gradually become a very common network crime, which poses a huge threat to the security of the user's computing resources. In addition, the high power consumption of mining also brings huge economic losses to the legitimate user.

[0004] Graphics cards are commonly used in gaming and image rendering fields. In recent years, deep learning has also become inseparable from high-parallel graphics cards for operation, thus prompting graphics cards to become an important and very common computing resource. As a commonly used high-performance computing device, graphics cards have become the target of many attackers. Attackers often target hosts with independent graphics cards, including personal computers, graphics card servers, cloud servers, etc.

[0005] Current detection methods for mining trojans focus on research on CPU mining hijacking, and there is little research on graphics card mining hijacking, which is difficult to migrate. The more common network traffic-based detection method can easily be hidden by attackers through encrypted communication, proxy, and dynamic domain name methods to escape detection. In addition, attackers can also use targeted obfuscation strategies to make existing methods ineffective. More seriously, existing detection methods all rely on host detection. Once the attacker intrudes the system and exploits vulnerabilities including software or system, the existing detection method can be immediately invalidated.

[0006] Therefore, those skilled in the art are committed to developing a detection method that does not rely on the host, using an independent hardware system, and monitoring the physical layer signals that are difficult to obfuscate, to overcome the shortcomings of existing systems. SUMMARY

[0007] In view of the above defects of the prior art, the technical problem to be solved by the present application is to overcome the problems that the detection process of the graphics card mining is easy to be hidden and escaped by attackers, and the detection method depends on the host end, so that the system software vulnerability is used by the attacker to make the detection method invalid, and a graphics card mining behavior detection method and device based on physical layer signals for detecting the graphics card mining Trojan horse based on the physical layer signals on the host are provided.

[0008] To achieve the above-mentioned purpose, the present application designs an independent hardware device and an independent graphics card detection method, which monitors the physical layer signals of the protected host, thereby achieving the purpose of detecting the mining behavior.

[0009] The technical scheme adopted by the present application is as follows:

[0010] The present application discloses a graphics card mining detection method based on physical layer signals, characterized in that the input current signal of the protected graphics card is monitored.

[0011] The input current signal of the graphics card is subjected to analog-to-digital conversion to obtain the current signal to be detected.

[0012] The current signal to be detected is tested by current absolute value, current variance and specific response frequency, and the current absolute value, current variance and specific response frequency are all set with corresponding test conditions, if any one or more of them meets the corresponding test condition, it is a non-mining module, and if none of them meets the corresponding test condition, it is a mining module output.

[0013] As a further improvement, the present application obtains the current signal to be detected for at least 0.015 seconds or more.

[0014] As a further improvement, the sampling rate of the analog-to-digital conversion is greater than 5000 Hz.

[0015] As a further improvement, the corresponding test condition of the current absolute value is that the time of the current signal to be detected less than 1.5A is greater than 90%.

[0016] As a further improvement, the corresponding test condition of the current variance is that the variance of the current signal to be detected is higher than 0.5.

[0017] As a further improvement, the current variance is divided into two categories by using K-neighbor clustering algorithm, the variance of the first category and the second category is calculated respectively, and then the weighted average V of the sum is calculated, and the weight is the number of data in the first category and the second category.

[0018] As a further improvement, the specific response frequency F calculation method of the application is as follows:

[0019] If the protected graphics card has N SM stream processors, each of which has N R registers, each mining function uses N r registers, and due to the warp execution strategy of the graphics card, each stream processor can run N warp warps at the same time, wherein

[0020] Therefore, the number of threads that each stream processor can run at the same time is N thread

[0021] N thread = 32 × N warp

[0022] Therefore, the response frequency F is

[0023] F = HashRate / (N thread × N sm ).

[0024] As a further improvement, the test condition of the specific response frequency of the application is that all sub-signals of the current signal to be detected do not contain the specific response frequency.

[0025] As a further improvement, the detection method of the specific response frequency in the sub-signal of the application is that the current signal to be detected is divided into several sub-signals, all sub-signals are high-pass filtered to filter out low-frequency components, then Fourier transform is performed to obtain a frequency domain signal, and it is verified whether the maximum value of the frequency domain signal is located in the interval [F-100, +∞). If yes, it is judged that the sub-signal contains the mining frequency response, otherwise, it does not.

[0026] The application also discloses a graphics card mining detection device based on a physical layer signal, the detection device is a hardware device independent of a protected host, comprising a current sensor connected to an input end of a graphics card, an analog-to-digital converter connected to the current sensor, and a processing and analysis module connected to the analog-to-digital converter.

[0027] The current sensor is used to monitor the input current signal of the protected graphics card.

[0028] The analog-to-digital converter is used to perform analog-to-digital conversion on the input current signal of the graphics card to obtain a current signal to be detected.

[0029] ​The processing test module is used for testing the current signal to be detected through current absolute value, current variance and specific response frequency, wherein the current absolute value, the current variance and the specific response frequency are all set with corresponding test conditions, if any one or more than one meets the corresponding test condition, it is a non-mining module, and if the current absolute value, the current variance and the specific response frequency all do not meet the corresponding test condition, it is a mining module output.

[0030] The beneficial effects of the present application are as follows:

[0031] The system can be deployed on a host computer equipped with a graphics card for real-time dynamic monitoring, and can also store the results for periodic offline monitoring.

[0032] First, the physical layer signal is monitored, so it is not easy to be attacked by confusion attack; second, an independent hardware system is used for monitoring and post-processing, so the system and software vulnerabilities of the protected host will not affect the final detection effect; third, a lightweight detection algorithm is used, which can be deployed on hardware devices with relatively low price, effectively controlling the cost. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 It is a flowchart of a mining detection method using independent hardware and based on graphics card physical layer signal monitoring;

[0034] Figure 2 It is a flowchart of the processing test module of the present application; Specific implementation method

[0035] The concept, specific structure and technical effects of the present application will be further described below with reference to the accompanying drawings, so as to fully understand the purpose, features and effects of the present application.

[0036] Figure 1 It is a flowchart of a mining detection method using independent hardware and based on graphics card physical layer signal monitoring; the present application discloses a graphics card mining behavior detection method and device based on physical layer signal, the detection device is a hardware device independent of the protected host, including a current sensor connected to the input end of the graphics card, an analog-to-digital converter connected to the current sensor, a processing and analysis module connected to the analog-to-digital converter;

[0037] The current sensor is used for monitoring the input current signal of the protected graphics card;

[0038] The analog-to-digital converter is used for analog-to-digital conversion of the input current signal of the graphics card to obtain the current signal to be detected;

[0039] The processing test module is used for testing the current signal to be detected by current absolute value, current variance and specific response frequency, and the current absolute value, current variance and specific response frequency are set with corresponding test conditions, if any one or more than one meets the corresponding test condition, it is a non-mining module, and if the current absolute value, current variance and specific response frequency do not meet the corresponding test conditions, it is a mining module output.

[0040] Compared with the general conventional graphics card program, the graphics card mining program mainly has the following characteristics, which can be used as the basis for judging the mining attack:

[0041] 1) Considering that the main operation content of the mining program is relatively simple and repeated hash function operation, the physical layer signal will have a response characteristic, more specifically, it will have a periodic characteristic;

[0042] 2) The mining program periodically performs the same operation, and the power consumption changes little, while the power consumption of the general graphics card program will fluctuate greatly with the change of its operation content, so compared with the general graphics card program, the power consumption of the graphics card changes little when executing the mining program.

[0043] 3) The mining program has high power consumption, so when the power consumption of the graphics card is low, it is usually not in the mining state.

[0044] Considering the above characteristics of the mining program, the present application mainly extracts the characteristics of the input current of the graphics card to realize the graphics card mining detection, including software algorithm and hardware implementation.

[0045] The hardware implementation of the present application includes:

[0046] 1) Use a current sensor to monitor the input current of the graphics card, and connect the input end of the current sensor to any one +12v pin connection of the 8-pin input current line of the graphics card;

[0047] 2) The output end of the current sensor is connected to Arduino (or other analog-to-digital conversion device), and analog-to-digital conversion is performed, and the sampling rate of analog-to-digital conversion is 9600 Hz;

[0048] 3) Raspberry Pi (or other processing system such as computer) obtains the current signal to be detected and performs post-processing, wherein the current signal to be detected is a continuous 1-second digital signal obtained from Arduino.

[0049] Figure 2This is a flowchart of the testing module of this invention; it can be performed in sequence as shown in the figure. If performed in sequence, the three parts of the test can be performed in any order, or the three parts can be performed simultaneously. The test standard is: the current signal to be tested is tested by the absolute value of the current, the variance of the current, and a specific response frequency. The absolute value of the current, the variance of the current, and the characteristic response frequency are all set with corresponding test conditions. If any one or more of the corresponding test conditions are met, it is a non-mining module. If the absolute value of the current, the variance of the current, and the characteristic response frequency do not meet the corresponding test conditions, it is a mining module output.

[0050] The software algorithm of this invention, namely a current-based mining detection algorithm, includes a three-layer filtering strategy, analyzing from both the time and frequency domains to detect mining behavior on the graphics card. Specifically, it includes the following steps:

[0051] 1) From a time domain perspective, due to the large current characteristic during mining, if the current is small, it is judged to be the regular graphics card program running. In actual deployment, if the time for the current signal to be detected to be less than 1.5A is greater than 0.9 seconds, it is judged to be executing a regular graphics card program (i.e., a non-mining program).

[0052] 2) Due to the characteristics of mining, the variance of its current waveform is significantly smaller than that of non-mining programs. Therefore, when the variance of the current signal to be detected is higher than 0.5, it is judged to be a regular graphics card program running.

[0053] 3) From a frequency domain perspective, due to the periodic nature of mining, its waveform will produce a specific frequency response, which can be used to distinguish whether mining is in progress; furthermore, the mining frequency F response of a specific graphics card is calculated as follows:

[0054] Assume the protected graphics card has N SM There are N stream processors, and each stream processor has N... R N registers, each mining function will use N r Due to the graphics card's warp execution strategy, each stream processor can run N registers simultaneously. warp Warp, of which

[0055] Therefore, the number of threads N that can run simultaneously per stream processor thread for

[0056] N thread =32×N warp

[0057] Therefore, the response frequency F is

[0058] F = HashRate / (N) rhread ×N sm )

[0059] Since the hash rate of the graphics card and the graphics card parameters are known quantities, the response frequency can be obtained from the above formula.

[0060] The scheme detects the mining frequency response of the current signal to be detected to determine whether it is a mining program. Since the attacker may weaken the frequency response by limiting the use rate of the graphics card, the scheme uses a block detection strategy. Specifically, the current signal to be detected is divided into 149 sub-signals using a sliding window with a window size of 128 and an overlap of 64, and each sub-signal is detected for mining frequency response.

[0061] The sub-signal mining frequency response detection method is: first, high-pass filter the sub-signal with a cutoff frequency of 100 Hz to filter out low-frequency components, then perform Fourier transform to obtain a frequency domain signal, and check whether the maximum value of the frequency domain signal is in the interval [F-100, +∞). If so, it is determined that the sub-signal contains a mining frequency response, otherwise it does not.

[0062] If none of the 149 sub-signals of the current signal to be detected contains a mining frequency response, it is determined that the graphics card is executing a regular graphics card program rather than a mining program, otherwise, if at least one sub-signal contains a mining frequency response, it is determined that the graphics card is executing a mining program

[0063] If none of the three steps is determined to be a regular graphics card program, it is determined that the graphics card is executing a mining program, and the system issues an alarm.

[0064] Using the present application, the existing graphics card mining software can be detected, achieving a recall rate of 95% and a false positive rate of 1%.

[0065] The present application can resist various obfuscation attacks, including graphics card power consumption limitation obfuscation attacks, binary file obfuscation attacks, and mining software implementation modification obfuscation attacks.

[0066] Currently, mining hijacking attacks are very frequent, for example, graphics card servers in university laboratories are often subjected to such attacks, which seriously threaten user computing resources and property safety. The present application provides a monitoring scheme independent of the host end, which can be used on personal computers, servers, cloud servers, and other graphics card hosts. Its lightweight hardware and software design makes the deployment cost low, has real application value, and is suitable for user-level and enterprise-level needs.

[0067] The above description of the embodiments is to assist those of ordinary skill in the art to understand and apply the present application. Those skilled in the art can easily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without creative labor. Therefore, the present application is not limited to the above embodiments, and improvements and modifications made to the present application by those skilled in the art based on the disclosure of the present application should be within the scope of protection of the present application.

Claims

1. A graphics card mining detection method based on a physical layer signal, characterized in that, monitoring the input current signal of a protected graphics card; analog-digital conversion of the input current signal of the graphics card to obtain a current signal to be detected; the current signal to be detected is tested by current absolute value, current variance and specific response frequency, the current absolute value, current variance and specific response frequency are all set with corresponding test conditions, if any one or more meets the corresponding test condition, it is a non-mining module, if the current absolute value, current variance and specific response frequency all do not meet the corresponding test condition, it is a mining module output; the specific response frequency F is calculated as follows: If the protected display card has N SM stream processors, each of which has N R registers, each mining function uses N r registers, and due to the warp execution strategy of the display card, each stream processor can run N warp warps at the same time, wherein Thus, the number of threads N that each flow processor can run concurrently thread for N thread = 32 x N warp Therefore, the response frequency F is F = HashRate / (N thread × N SM ).

2. The method of claim 1, wherein the method further comprises: the acquisition of the physical layer signal to be detected is to acquire the current signal to be detected for at least 0.015 seconds or more.

3. The method of claim 2, wherein the method further comprises: The sampling rate of the analog-digital conversion is greater than 5000 Hz.

4. The physical layer signal based graphics card mining detection method according to claim 1 or 2 or 3, characterized in that, The corresponding test condition of the current absolute value is that the time of the current signal to be detected less than 1.5 A is greater than 90%.

5. The physical layer signal based detection method of graphics card mining according to claim 4, wherein, The corresponding test condition of the current variance is that the variance of the current signal to be detected is higher than 0.

5.

6. The physical layer signal based detection method of graphics card mining according to claim 1 or 5, characterized in that, The current variance is divided into two classes by using K-nearest neighbor clustering algorithm, the variance of the first class and the second class is calculated respectively, and then the weighted average V of the sum is calculated, and the weight is the number of data in the first class and the second class.

7. The physical layer signal based detection of graphics card mining method according to claim 1, wherein, The test condition of the specific response frequency is whether all sub-signals of the current signal to be detected contain the specific response frequency.

8. The physical layer signal based detection method of graphics card mining according to claim 7, wherein, The detection method of the specific response frequency in the sub-signal is that the current signal to be detected is divided into several sub-signals, all sub-signals are high-pass filtered to filter out low-frequency components, then Fourier transform is performed to obtain frequency domain signal, and it is judged whether the maximum value of the frequency domain signal is located in the interval [F-100, +∞), if yes, it is judged that the sub-signal contains mining frequency response, otherwise, it does not contain. 9.A device for detecting a graphics card mining based on a physical layer signal, characterized in that, The detection device is a hardware device independent of the protected host, including a current sensor connected to the input end of the graphics card, an analog-digital converter connected to the current sensor, and a processing analysis module connected to the analog-digital converter; a current sensor for monitoring the input current signal of a protected graphics card; analog-digital converter for analog-digital conversion of the input current signal of the graphics card to obtain a current signal to be detected; the processing test module is used for testing the current signal to be detected by current absolute value, current variance and specific response frequency, the current absolute value, current variance and specific response frequency are all set with corresponding test conditions, if any one or more meets the corresponding test condition, it is a non-mining module, if the current absolute value, current variance and specific response frequency all do not meet the corresponding test condition, it is a mining module output; the specific response frequency F is calculated as follows: If the protected display card has N SM flow processors, each of which has N R registers, each mining function uses N r registers, and due to the warp execution strategy of the display card, each flow processor can run N warp warp at the same time, wherein Thus, the number of threads N that each stream processor can run concurrently thread is N thread = 32 x N warp Therefore, the response frequency F is F = HashRate / (N thread ×N SM ).

Images