A mining behavior detection method combining active and passive detection technologies

Abstract

The application discloses a mining behavior identification method combining active and passive detection technologies, comprising flow side identification, wherein the flow side identification comprises passive detection and active detection, and specifically comprises the following contents: obtaining packet features of mining pool miner communication through passive detection; constructing a packet to send to the mining pool, and analyzing and judging returned data; obtaining IP addresses of known mining pools through the passive detection method, obtaining the mining pool server fingerprint by using JARM, searching for IP addresses of the same fingerprint by using a space survey product, actively sending a request by constructing a data packet, analyzing a response result, and judging the belonging mining pool of the IP. The application combines the active and passive detection technologies, can independently detect possible mining machines and mining pools and mining behaviors while monitoring the flow features of the mining behaviors and the device resource occupation caused by the behaviors, and blocks the high-threat mining behaviors hidden deeply.

Description

TECHNICAL FIELD

[0001] The present application relates to a virtual currency mining detection method, in particular to a method for detecting and identifying network traffic related to mining behavior on an industrial control device. BACKGROUND

[0002] Since 2008, based on Bitcoin and blockchain, several digital currencies or virtual currencies based on cryptography principles have been created, which are protected by encryption technology. This virtual currency is also called "cryptocurrency". In addition to being traded with legal currency on trading platforms through exchange rates, cryptocurrency can also be obtained by using computers or other devices to complete a certain "computing task". The process of obtaining cryptocurrency by completing a "computing task" is called "mining", and the user performing the mining behavior is called a "miner". The device used by the miner for mining is called a "miner". The "computing task" is also called "proof of work". Satoshi Nakamoto proposed Bitcoin and a consensus mechanism called "proof of work". Miners need to use mining equipment to perform a large number of computing tasks during the mining process until they find a result that meets the conditions, and then they can obtain a certain amount of Bitcoin as a reward.

[0003] Therefore, many users have accumulated mining equipment, built mining farms, and consumed a large amount of water and electricity resources for mining. Round after round of coin speculation has caused the market value of various cryptocurrencies to rise, and some malicious hackers have turned their attention to the cryptocurrency market, using mining scripts to monetize traffic, making mining viruses one of the most frequently used attack methods by such hackers. Mining activities of cryptocurrencies not only consume a large amount of energy and carbon emissions, but also have a low contribution to the development of the national economy. Moreover, the risks derived from its production and trading are becoming increasingly prominent, and its blind and disorderly development is adversely affecting the high-quality development of the economy and society and energy saving and emission reduction.

[0004] From a macro perspective, the harm of mining behavior: mining activities will cause a sharp increase in industry and social overall power consumption, and the supply of electric power energy will shift from real to virtual, and carbon emissions will increase, which is not conducive to energy saving and emission reduction. At the same time, virtual currency transactions disrupt the normal financial order.

[0005] From a micro perspective, the harm of mining behavior: malicious mining behavior will consume a large amount of computing resources of host devices, causing a sharp decline in the performance of existing business hosts, and interfering with the normal operation of business. Long-term mining behavior will increase the cost of electricity for enterprises, reduce the running speed of all other processes of host devices, shorten the service life of the system, and even cause the host device to crash, resulting in data loss.

[0006] Mining behavior is essentially to complete a series of computing tasks, which are usually issued by a "pool" in the entire joint mining activity. A pool will be in communication with multiple miners, issue mining tasks to them, accept and verify the submitted mining results. Therefore, many existing mining behavior identification technologies are from network traffic, and are aimed at the protocol characteristics of traffic communication in the mining behavior process for judgment and identification. However, with the improvement of mining activity technology, many mining behaviors have gradually begun to use encryption tunnels, encrypted communication and other technologies, so that traditional traffic feature identification cannot accurately detect. SUMMARY

[0007] The purpose of the present application is to provide a technical solution based on traffic and host sides, combining active and passive detection technologies, which can monitor the traffic characteristics of mining behavior and the device resource occupation caused by the behavior, and also actively detect the pool address.

[0008] Technical solution: A mining behavior identification method combining active and passive detection technologies, including traffic side identification, the traffic side identification including passive detection and active detection, the specific steps are as follows:

[0009] Obtain the message characteristics of the pool miner communication through passive detection;

[0010] Construct a message to send to the pool and analyze and judge the returned data;

[0011] Obtain the IP address of the known pool through passive detection, use JARM to obtain the server fingerprint of the pool, search for the IP address with the same fingerprint using a spatial mapping product, construct a data packet to actively send a request, analyze the response result, and judge the IP belonging pool.

[0012] Further, according to the general features of the mining protocol, IOC, the characteristic keywords of different currencies and the encryption identification fingerprint, the passive detection includes one or more of static detection, fingerprint identification and dynamic detection, the static detection is for plaintext mining communication, and the fingerprint identification and / or dynamic detection is for encrypted mining communication.

[0013] Among them, the static detection includes the following contents:

[0014] The mining pool and the mining machine follow a specific mining protocol in the mining activity, so that the data of network communication is packaged and transmitted in a certain specific format. According to the mining protocol, the mining environment is deployed, the mining test is carried out, and the traffic package is captured, the traffic characteristics of the mining pool and the mining machine in the communication process are analyzed, and the keywords are extracted as static rules. Optionally, the mining protocol is stratum protocol, in the mining activity following the stratum protocol, the storage and transmission of data are in JSON-RPC format. JSON-RPC has several specific fields: id, jsonrpc (version), error, results, etc. Among these field names, there may be currency names, and the protocol used. In addition, after capturing the traffic package, the handshake information in the communication process can also be viewed, whether there is an ssl certificate, etc.

[0015] The fingerprint identification is for the encrypted communication process using HTTPS, and the part of the ClientHello related to the TLS metadata is extracted to generate a hash fingerprint for identification.

[0016] The dynamic detection includes the following contents:

[0017] Considering the communication traffic characteristics between the mining pool and the mining machine, starting from the data flow dimension, by collecting data in different environments, the communication flow characteristics are extracted, the feature engineering is constructed, the machine learning model is built, the data set is divided into training set, test set and validation set three parts, and the binary classification identification is carried out.

[0018] The mining behavior recognition method further includes host side recognition, the host side recognition carries out reverse analysis on the mining machine firmware, reads the code of the mining machine firmware in the communication function, analyzes the communication mode and characteristics of the mining machine firmware, and then uses the traffic side method to obtain the address of the mining pool. Further, the host side recognition uses tools to monitor system resource occupation in each hardware terminal, identifies related processes, services, and uses file detection, sandbox tools to detect mining scripts.

[0019] Beneficial effects

[0020] Compared with the prior art, the present application combines passive detection and active detection, and has the following significant progress:

[0021] 1. Deep analysis of existing public protocols and private protocols, selection of appropriate passive detection methods according to the structural characteristics and communication characteristics of different currencies, or combination of multiple passive detection methods for feature extraction to accurately obtain the message characteristics of the mining pool and mining machine communication. 2. Active detection based on the message characteristics obtained by passive detection to construct messages, analyze and judge the returned data to identify assets and services, and combine JARM and spatial mapping to autonomously detect possible mining machines, mining pools and mining behaviors, and block deeper hidden high-threat mining behaviors; 3. Monitor the resource occupation and process resources of the device on the host side. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 A framework diagram of a mining behavior identification method combining active and passive detection technologies according to the present application;

[0023] Figure 2 Part of the screenshot of the mining data stream (including protocol characteristics);

[0024] Figure 3 Mining communication process (fingerprint identification for HTTPS encrypted communication);

[0025] Figure 4 Code diagram of JARM;

[0026] Figure 5 (a) and (b) are achievement case diagrams. DETAILED DESCRIPTION

[0027] The following examples are only used to more clearly illustrate the technical solutions of the present application, and therefore only serve as examples, and cannot limit the protection scope of the present application.

[0028] A mining behavior identification method combining active and passive detection technologies, including flow side identification, which includes passive detection and active detection. Preferably, the mining behavior identification method further includes host side identification, which monitors the resource occupation and process resources of the device on the host side to further improve and strengthen the mining behavior identification strength.

[0029] The contents of passive detection, active detection and host side identification are described in detail below.

[0030] 1. Flow side identification

[0031] 1.1 Passive detection

[0032] (1) Static detection of plaintext communication

[0033] The communication between the mining pool and the mining machine during the mining activity needs to follow a specific protocol. By deploying a mining environment, conducting mining tests, and capturing traffic packets, some specific traffic characteristics in the communication process can be analyzed. The keywords extracted from these characteristics can be used as static rules for detection and identification. This identification method is called static detection in passive detection.

[0034] Bitcoin protocol is followed when Bitcoin synchronizes block data in P2P network, which has a specific set of network message types and fixed strings. Other cryptocurrencies developed based on Bitcoin, such as Dash and Litecoin, retain most of the features of Bitcoin protocol in their core wallet applications, with only some simple modifications to distinguish themselves from Bitcoin. The core client of cryptocurrency is not all based on Bitcoin. Ethereum, which symbolizes the 2.0 stage of blockchain, has another set of communication rules, and uses RLP (Recursive Linear Prefix) to encode communication data, so it cannot be directly analyzed by packet capture to extract keywords for static identification. Monero and other cryptocurrencies developed on its basis, such as Electroneum, Oxen, and Sumokoin, also have their own communication protocol. Because the communication process is not encrypted, it can also be analyzed by packet capture and source code to extract feature keywords for static detection.

[0035] The communication between the mining machine and the mining pool during the mining process currently mainly follows the stratum protocol. The stratum protocol strictly specifies the interface data structure and interaction logic of the mining machine and the mining pool. The mining machine needs to follow the specific structure specified by the stratum protocol to start subscribing to tasks, verify authorization, receive tasks, and submit results. The stratum protocol is a TCP communication protocol based on JSON-RPC2.0, with JSON data format and multiple fixed feature fields. There is a fixed data structure and feature keyword in the communication process between the mining pool and the mining machine. According to this feature, rules can be extracted by packet capture and source code analysis for static detection.

[0036] As shown in Figure 2 , reference numerals 1-3 are the main identification features. 1 indicates that the currency uses the "Bitcoin" protocol, 2 indicates the protocol version number, and 3 indicates the fixed string carried in the communication of the currency, which can be used as one of the string features for identifying the currency.

[0037] (2) Fingerprint identification detection of encrypted communication

[0038] In the above environment deployment and packet analysis process, not all communication traffic is transmitted in plaintext, and some currencies can use TLS to encrypt the communication process during mining. This type of mining behavior cannot be identified by matching static rules. However, due to the characteristics of the TLS protocol itself, the transmitted data content is encrypted, but there is a plaintext transmission process in the process of establishing a connection and exchanging certificates. In theory, for the same type of large mining pool or currency, the encryption certificate used by HTTPS and the related password suite key should be consistent. Therefore, for this type of encrypted communication mining behavior, the part of the ClientHello related to the TLS metadata can be extracted to generate a hash fingerprint for identification.

[0039] (3) Dynamic detection of encrypted communication

[0040] In view of the problem that static detection cannot effectively identify encrypted communication, fingerprint identification can achieve good identification effect. However, since most of the cryptocurrencies are open source now, miners with programming ability can bypass static detection and fingerprint identification by modifying the keywords in the source code; or the miners use VPN or other proxy means when connecting the mining machine and the mining pool, and in this case, neither static detection nor fingerprint identification is applicable. To this end, a dynamic detection method is adopted to consider the communication traffic characteristics between the mining pool and the mining machine, and different communication behaviors are identified in this dimension. In view of the characteristics of long connection and fixed frequency interaction of the communication activities between the mining pool and the mining machine, the data stream dimension can be started, the communication flow characteristics can be extracted by collecting data in different environments, the feature engineering can be constructed, various machine learning models (decision tree, KNN classification model, etc.) can be used to build the model, and the data set can be divided into training set, test set and validation set three parts. Binary classification identification is performed.

[0041] In order to effectively identify mining activities, the present application flexibly uses corresponding means for different mining activities. Simply speaking, plaintext mining communication can use static detection, and encrypted mining communication cannot be identified by the foregoing static detection, then fingerprint identification can be used, and when fingerprint identification cannot work, dynamic detection is used.

[0042] For feature extraction methods, the extraction methods of most currencies are similar, and usually they are classified according to whether the communication is encrypted, the protocol used by the currency, the code framework of the currency, etc. Different feature extraction methods are adopted for currencies meeting the above different classifications.

[0043] For example, encrypted communications are hashed using extracted TLS metadata, while unencrypted communications are directly analyzed for keywords in the plaintext. Coins that use the stratum protocol can be filtered for stratum protocol fields to analyze their characteristics (coin name, pool address, etc.). Some coins are developed on the basis of Bitcoin and have similar characteristics, so Bitcoin analysis methods can be used to analyze these coins.

[0044] The three categories mentioned above are not mutually exclusive. For example, a coin may use the Bitcoin code framework and stratum communication protocol, but it may be encrypted. In this case, both the encrypted communication identification method and the stratum protocol method can be used for identification. Different coin structures and communication characteristics can be combined to apply various feature extraction methods.

[0045] 1.2 Active probing

[0046] Passive probing is a method of packet analysis and identification by communicating with the mining pool during the mining process. Based on this, the characteristics of the mining pool's communication packets can be known. Active probing is a method of constructing packets based on the characteristics of the mining pool's communication packets and analyzing the returned data to achieve identification (i.e., asset and service identification). In combination with JARM and spatial mapping techniques, it can detect possible mining machines and mining pools and block deep hidden high-threat mining behaviors at a deeper level. JARM is a tool for actively sending packets to identify TLS layer server fingerprints. It is mainly used to quickly detect whether all servers in a cluster have the same TLS configuration, identify the organization to which the server belongs, and identify default applications or infrastructure. First, the IP addresses of known mining pools are obtained through passive probing, and the JARM tool is used to obtain their server fingerprints. Then, the spatial mapping product is used to search for IP addresses with the same JARM value. Finally, mining machine data packets are constructed and actively sent to request, and the response results and data are used to determine whether they belong to the same mining pool.

[0047] 2. Host-side identification

[0048] Both passive and active probing belong to traffic-side mining behavior detection and identification methods. For some special mining machines, such as Antminer ASIC miners, because they use special firmware internally, reverse analysis techniques can be used to analyze their communication methods and characteristics, and remote identification or passive static identification can be constructed (i.e., using the traffic-side method described above, actively initiating a connection with the mining pool to perform remote identification, or passively obtaining the address of the mining pool to perform a ban or other operations).

[0049] In addition, the tool monitoring system resource occupation can be used to identify related processes, services, and use file detection, sandbox tools, etc. to detect mining scripts.

[0050] The difference between the host side and the traffic side is that the internal of the mining host usually has a dedicated firmware, and the communication features in it are different from the communication features of the mining software. Their common point is that because the mining activity will have network communication, they cannot do without the method of the traffic side.

[0051] The following is Figure 1 As a preferred embodiment, the mining activity detection scheme of the present application is further described:

[0052] Step 1, static detection and fingerprint identification in mining activity passive detection, mainly through keyword identification of cryptocurrency currency, protocol, IOC and encryption fingerprint (fingerprint identification is not shown in the middle) to extract rules. Figure 1

[0053] Step 2, start the traffic analysis engine to analyze the traffic, filter the network communication traffic of the detection device, and at the same time enable the host side detection engine to monitor the resource occupation and process information of the device, and alarm the process file with high CPU and high memory occupation ratio.

[0054] Step 3, for some encrypted communications with long connection, frequent communication, long transmission message, etc. Dynamic detection is used to analyze the TCP long connection that may exist in the login authentication and task assignment process to further determine whether it is a mining behavior.

[0055] Step 4, for the IP that has been detected and determined as a mining pool address, use JARM tool to obtain the server fingerprint of the mining pool address, and use the space mapping product to search for IP addresses with the same JARM value, and then construct a mining machine data packet to actively send a request to the suspicious IP, and according to the response result and data to determine whether it is an IP pool under the same mining pool.

[0056] The above-described embodiments only express the optional and / or preferred embodiments of the present application, which are described in more detail and in detail, but should not be construed as limiting the scope of the present application. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of the present application.​

Claims

1. A method for identifying mining behavior by combining active and passive detection techniques, characterized in that, The flow side identification includes passive detection and active detection, and the specific steps are as follows: Obtain the message characteristics of the mining pool miner communication through passive detection; Based on the message characteristics, a message is constructed and sent to the mining pool, and the data returned by the mining pool is analyzed to obtain the analysis results of the asset information and service information of the mining pool; Obtain the IP address of the known mining pool through passive detection, use JARM to obtain the server fingerprint of the known mining pool, search for the same IP address to be verified using a space mapping product based on the server fingerprint, construct a data packet based on the IP address to be verified, and actively send the data packet to the IP address to be verified, analyze the response result returned by the IP address to be verified, and obtain the judgment result of whether the IP address to be verified belongs to the mining pool.

2. The mining behavior identification method of claim 1, wherein, The passive detection includes one or more of static detection, fingerprint identification, and dynamic detection, the static detection is for plaintext mining communication, and the fingerprint identification and / or dynamic detection is for encrypted mining communication.

3. The mining behavior identification method of claim 2, wherein, The static detection includes the following contents: The mining pool and the miner follow a mining protocol in the mining activity, deploy a mining environment according to the mining protocol, perform mining testing and capture traffic packets, analyze the traffic characteristics of the mining pool and the miner in the communication process, and extract keywords as static rules.

4. The mining behavior identification method of claim 3, wherein, Extract keywords through packet capture and source code analysis.

5. The mining behavior identification method of claim 3, wherein, After capturing traffic packets, view the handshake information in the communication process.

6. The mining behavior identification method of claim 3, wherein, The mining protocol is a stratum protocol, and the storage and transmission of data are in JSON-RPC format, and the fields of the JSON-RPC format include id, jsonrpc, error, and results.

7. The mining behavior recognition method of claim 2, wherein, The fingerprint identification is for encrypted communication process using HTTPS, and the part of the Client Hello related to the TLS metadata is extracted to generate a hash fingerprint for identification.

8. The mining behavior recognition method of claim 2, wherein, The dynamic detection includes the following contents: Consider the communication traffic characteristics between the mining pool and the miner, start from the data flow dimension, collect data in different environments, extract communication flow characteristics, build a feature engineering, build a machine learning model, divide the data set into three parts of training set, test set and validation set, and perform binary classification identification.

9. The mining behavior identification method of any one of claims 1-8, characterized in that, The host side identification includes reverse analysis of the miner firmware, reading the code of the miner firmware in the communication function, analyzing the communication method and characteristics of the miner firmware, and then using the flow side method to obtain the address of the mining pool.

10. The mining behavior identification method of claim 9, characterized in that, The host side identification uses tools to monitor system resource occupation on each hardware terminal, identifies related processes, services, and uses file detection, sandbox tools to detect mining scripts.

Images