Method and device for identifying cryptocurrency miners and readable storage medium

Abstract

The invention provides a method and device for identifying cryptocurrency miners and a readable storage medium, and relates to the technical field of mining, and the method comprises the steps: obtaining a DNS traffic log and an RADIUS user access log; the method comprises the following steps: acquiring traffic characteristics of target traffic of a target user from a DNS traffic log and an RADIUS user access log by utilizing a characteristic device, wherein the traffic characteristics comprise a request internet protocol (IP) and a port, the size and the number of data packets, domain name information and an encryption / non-encryption mark; in response to the fact that the target flow is encrypted flow, the flow features are input into a trained mining flow recognition model, and a recognition result about whether the target flow is mine pool flow or not is obtained; and identifying the target user as the cryptocurrency miner in response to the fact that the target flow is the mine pool flow. According to the method, the device and the medium, the problems that the existing method for discovering miners is mainly realized by identifying the flow content, but the efficiency and the accuracy are low when the mining flow is mostly encrypted and the flow content is directly identified can be solved.

Description

Technical Field

[0001] The present invention relates to the field of mining technology, and in particular to a method, device and readable storage medium for identifying cryptocurrency miners. Background Art

[0002] Cryptocurrency mining has become a popular business activity, but using mining resources without the owner's consent can have negative consequences, such as increased energy consumption and decreased performance.

[0003] Currently, the method of discovering miners is mostly to identify the traffic content, but mining traffic is mostly encrypted traffic, and directly identifying the traffic content is inefficient and inaccurate. Summary of the invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art and to provide a method, device and readable storage medium for identifying cryptocurrency miners, so as to solve the problem that the existing method for discovering miners is mainly achieved by identifying traffic content, but since mining traffic is mostly encrypted traffic, direct traffic content identification has the problems of low efficiency and low accuracy.

[0005] In a first aspect, the present invention provides a method for identifying cryptocurrency miners,

[0006] Methods include:

[0007] Obtain Domain Name System (DNS) traffic logs and Remote Authentication Dial-In User Service (RADIUS) user access logs;

[0008] Using a characterizer to obtain traffic characteristics of target user target traffic from the DNS traffic log and the RADIUS user access log, the traffic characteristics including request Internet Protocol IP and port, data packet size and quantity, domain name information, and encryption / non-encryption flag;

[0009] In response to the target traffic being encrypted traffic, inputting the traffic feature into a trained mining traffic identification model to obtain an identification result of whether the target traffic is mining pool traffic;

[0010] In response to the target traffic being mining pool traffic, the target user is identified as a cryptocurrency miner.

[0011] Furthermore, the obtaining of the domain name system DNS traffic log and the remote authentication dial-in user service RADIUS user access log specifically includes:

[0012] Get the DNS protocol image and the RADIUS protocol image;

[0013] According to the mirror image of the DNS protocol and the mirror image of the RADIUS protocol, the DNS traffic log and the RADIUS user access log are collected in real time.

[0014] Furthermore, before inputting the traffic feature into the trained mining traffic identification model to obtain an identification result of whether the target traffic is mining pool traffic, the method further includes:

[0015] Collect mining pool data, historical DNS traffic logs, and historical RADIUS user access logs;

[0016] Marking the mining pool data, and normalizing the historical DNS traffic logs and historical RADIUS user access logs;

[0017] Obtaining traffic feature training data and corresponding labels based on the labeled mining pool data and the normalized historical DNS traffic logs and historical RADIUS user access logs;

[0018] The mining traffic identification model is trained using traffic feature training data and corresponding labels to obtain the trained mining traffic identification model.

[0019] Furthermore, after collecting the mining pool data and the historical DNS traffic logs and the historical RADIUS user access logs, the method further includes:

[0020] Using a relational database to store the mining pool data;

[0021] A column-based database is used to store the historical DNS traffic logs and historical RADIUS user access logs.

[0022] Furthermore, the mining traffic identification model includes a bisection K-means model and a Gaussian mixture model GMM model; the traffic feature is input into the trained mining traffic identification model to obtain an identification result of whether the target traffic is a mining pool traffic, specifically including:

[0023] Inputting the traffic features into a Bisecting K-means model so that the Bisecting K-means model clusters the traffic features to obtain a clustering result;

[0024] Use the GMM model to perform probability analysis on the clustering results, obtain the probability of whether the target traffic belongs to a specific mining activity, and output a probability distribution result;

[0025] An identification result of whether the target flow is a mining pool flow is obtained according to the probability distribution result.

[0026] Furthermore, the method further comprises:

[0027] In response to the target traffic being non-encrypted traffic and the connecting domain name being a suspected mining pool domain name, identifying the target traffic as mining pool traffic;

[0028] In response to the target traffic being non-encrypted traffic and the connection domain name being not a mining pool domain name, whether the target traffic is mining pool traffic is determined by using the trained mining traffic identification model.

[0029] Furthermore, the method further comprises:

[0030] The identification result of the target flow is fed back to the feature device so that the feature device can self-evolve.

[0031] In a second aspect, the present invention provides a device for identifying cryptocurrency miners, the device comprising:

[0032] Log data acquisition module, used to obtain domain name system DNS traffic logs and remote authentication dial-in user service RADIUS user access logs;

[0033] A traffic feature acquisition module, connected to the log data acquisition module, for acquiring traffic features of target user target traffic from the DNS traffic log and the RADIUS user access log using a feature detector, wherein the traffic features include request Internet Protocol IP and port, data packet size and quantity, domain name information, and encryption / non-encryption flag;

[0034] A mining pool flow identification module, connected to the flow feature acquisition module, for inputting the flow feature into a trained mining flow identification model in response to the target flow being encrypted flow, to obtain an identification result of whether the target flow is mining pool flow;

[0035] The cryptocurrency miner identification module is connected to the mining pool traffic identification module and is used to identify the target user as a cryptocurrency miner in response to the target traffic being mining pool traffic.

[0036] In a third aspect, the present invention provides a device for identifying cryptocurrency miners, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the method for identifying cryptocurrency miners described in the first aspect.

[0037] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for identifying cryptocurrency miners described in the first aspect above is implemented.

[0038] The present invention provides a method, device and readable storage medium for identifying cryptocurrency miners. First, obtain the domain name system DNS traffic log and the remote authentication dial-in user service RADIUS user access log; and use the feature device to obtain the traffic characteristics of the target user's target traffic from the DNS traffic log and the RADIUS user access log, and the traffic characteristics include the requested Internet Protocol IP and port, the size and number of data packets, domain name information, and the encryption / non-encryption flag; then in response to the target traffic being encrypted traffic, input the traffic characteristics into the trained mining traffic identification model to obtain the identification result of whether the target traffic is a mining pool traffic; and in response to the target traffic being a mining pool traffic, identify the target user as a cryptocurrency miner. The present invention effectively overcomes the low efficiency and accuracy problems of traditional technologies in identifying encrypted mining traffic by analyzing traffic characteristics rather than traffic content. The method performs well in real-time, accuracy and robustness, and has a low false alarm rate and false negative rate, which can effectively avoid false access and improve the accuracy of mining traffic identification. This solves the problem that the existing method of discovering miners is mainly achieved by identifying traffic content, but since mining traffic is mostly encrypted traffic, direct traffic content identification has the problems of low efficiency and low accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flow chart of a method for identifying cryptocurrency miners according to Embodiment 1 of the present invention;

[0040] Figure 2 This is a flow chart of another method for identifying cryptocurrency miners according to Embodiment 1 of the present invention;

[0041] Figure 3 This is a flowchart of another method for identifying cryptocurrency miners according to Embodiment 1 of the present invention;

[0042] Figure 4 This is a schematic diagram of the structure of a device for identifying cryptocurrency miners according to Embodiment 2 of the present invention;

[0043] Figure 5 This is a schematic diagram of the structure of a device for identifying cryptocurrency miners according to Example 3 of the present invention. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0045] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0046] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0047] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0048] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0049] It can be understood that the terms "first", "second", etc. in the embodiments of the present invention are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0050] It can be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0051] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0052] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0053] Embodiment 1:

[0054] This embodiment provides a method for identifying cryptocurrency miners, such as Figure 1 As shown, the method includes:

[0055] Step S101: Obtain DNS (Domain Name System) traffic log and RADIUS (Remote Authentication Dial-In User Service) user access log.

[0056] In this embodiment, the DNS traffic log may include information such as IP (Internet Protocol), port, time, domain name, etc. The RADIUS user access log is mainly a log file used to record user access information of the RADIUS server, which may include user account, account corresponding IP, time, etc.

[0057] Optionally, the obtaining of Domain Name System DNS traffic logs and Remote Authentication Dial-In User Service RADIUS user access logs specifically includes:

[0058] Get the DNS protocol image and the RADIUS protocol image;

[0059] According to the mirror image of the DNS protocol and the mirror image of the RADIUS protocol, the DNS traffic log and the RADIUS user access log are collected in real time.

[0060] In this embodiment, the image of the DNS protocol and the image of the RADIUS protocol can be obtained first, and then the collector can be used to collect the DNS traffic log and the RADIUS user access log in real time. The collector can customize the time period for monitoring operation.

[0061] Step S102: Using a characterizer to obtain traffic characteristics of the target user's target traffic from the DNS traffic log and the RADIUS user access log, the traffic characteristics include requesting Internet Protocol IP and port, data packet size and quantity, domain name information, and encryption / non-encryption flag.

[0062] In this embodiment, the traffic characteristics include: request IP and port: used to determine the target of the traffic; packet size and number: may indicate specific mining activities; domain name information: whether it matches a known mining pool domain name; encryption / non-encryption flag: whether the traffic is encrypted, which may indicate different mining tools and methods.

[0063] Optionally, before inputting the traffic feature into a trained mining traffic identification model to obtain an identification result of whether the target traffic is mining pool traffic, the method further includes:

[0064] Collect mining pool data, historical DNS traffic logs, and historical RADIUS user access logs;

[0065] Marking the mining pool data, and normalizing the historical DNS traffic logs and historical RADIUS user access logs;

[0066] Obtaining traffic feature training data and corresponding labels based on the labeled mining pool data and the normalized historical DNS traffic logs and historical RADIUS user access logs;

[0067] The mining traffic identification model is trained using traffic feature training data and corresponding labels to obtain the trained mining traffic identification model.

[0068] In this embodiment, the mining pool data at least includes the mining pool domain name, and the mining pool data is labeled. The labeled label represents the unique identification ID of the mining pool / currency, such as (mining pool domain name, mining pool ID), or ETH, BTC, XMR, etc.

[0069] In this embodiment, the historical DNS traffic log and the historical RADIUS user access log can be normalized to form a sequence, which can include user name, hour, mining pool ID, and access times. The traffic feature training data corresponding to all users is obtained based on the sequence.

[0070] Optionally, after collecting the mining pool data and the historical DNS traffic logs and the historical RADIUS user access logs, the method further includes:

[0071] Using a relational database to store the mining pool data;

[0072] A column-based database is used to store the historical DNS traffic logs and historical RADIUS user access logs.

[0073] In this embodiment, considering the structured characteristics of the mining pool address, a relational database (such as PostgreSQL or MySQL) can be used to effectively manage structured data and provide powerful data operation capabilities through SQL queries. For DNS traffic logs and RADIUS user access logs, since they usually involve a large number of write operations (a certain column) and log data, full storage can use a columnar database system for big data processing (such as Clickhouse) because they can provide high-throughput write operations and horizontal scalability.

[0074] Step S103: In response to the target traffic being encrypted traffic, the traffic characteristics are input into a trained mining traffic identification model to obtain an identification result of whether the target traffic is mining pool traffic.

[0075] In this embodiment, the encryption / non-encryption flag of the target traffic can be used to determine whether it is encrypted traffic. If it is encrypted traffic, the traffic characteristics are input into a trained mining traffic identification model to obtain an identification result of whether the target traffic is a mining pool traffic.

[0076] Optionally, the mining traffic identification model includes a Bisecting K-means model and a GMM (Gaussian Mixture Model) model; the step of inputting the traffic feature into the trained mining traffic identification model to obtain an identification result of whether the target traffic is a mining pool traffic specifically includes:

[0077] Inputting the traffic features into a Bisecting K-means model so that the Bisecting K-means model clusters the traffic features to obtain a clustering result;

[0078] Use the GMM model to perform probability analysis on the clustering results, obtain the probability of whether the target traffic belongs to a specific mining activity, and output a probability distribution result;

[0079] An identification result of whether the target flow is a mining pool flow is obtained according to the probability distribution result.

[0080] In this embodiment, the mining traffic identification model adopts a hybrid model correlation method, using Bisecting k-means (Bisection k-means) and GMM (Gaussian mixture model) models, and automatically runs out the result data based on the preprocessed data and the hybrid model results.

[0081] (a) Bisecting k-means: This model is used to cluster the user's traffic features and output the clustering results. The clustering results are used to indicate whether the traffic features are mining features, such as suspected mining features and non-mining features.

[0082] (b) GMM: The GMM model further performs probability analysis on these clustering results, calculates the probability that the target traffic belongs to a specific mining activity, and outputs the probability distribution result.

[0083] A probability threshold (such as 0.5) is set according to demand. If the probability value of the target traffic in a specific mining activity is higher than the threshold, the target traffic is identified as belonging to the specific mining activity, that is, it is determined to be mining pool traffic.

[0084] Step S104: In response to the target traffic being mining pool traffic, identifying the target user as a cryptocurrency miner.

[0085] In this embodiment, if the target traffic is identified as mining pool traffic, then the source user of the target traffic (ie, the target user, ie, the corresponding miner) will be identified as a cryptocurrency miner.

[0086] Optionally, the method further comprises:

[0087] In response to the target traffic being non-encrypted traffic and the connecting domain name being a suspected mining pool domain name, identifying the target traffic as mining pool traffic;

[0088] In response to the target traffic being non-encrypted traffic and the connection domain name being not a mining pool domain name, whether the target traffic is mining pool traffic is determined by using the trained mining traffic identification model.

[0089] In this embodiment, for non-encrypted traffic, if the connecting domain name is a suspected mining pool domain name, it will be identified as mining pool traffic; for non-encrypted traffic, if the connecting domain name is not a mining pool domain name, it can be determined whether the target traffic is mining pool traffic through the trained mining traffic identification model. If so, it is identified as mining pool traffic.

[0090] Optionally, the method further comprises:

[0091] The identification result of the target flow is fed back to the feature device so that the feature device can self-evolve.

[0092] In this embodiment, when the system enters the stable operation stage, the feature detector will start the self-evolution mechanism. Through continuous machine learning and algorithm optimization, the system can automatically identify new mining behavior features (i.e., traffic features) and continuously improve the recognition mode of existing features. This self-evolution capability ensures that the system can adaptively update its recognition capabilities as the mining behavior evolves and becomes more complex, thereby maintaining high efficiency and accuracy in a dynamic network environment.

[0093] In a specific embodiment, the method for identifying cryptocurrency miners accurately locates the miner address based on DNS traffic logs / RADIUS user access logs, such as Figure 2 As shown, it is mainly divided into the following steps:

[0094] (1) Collector:

[0095] The mining pool collector obtains mining pool data through web crawlers / manual import / automatic collection, which includes information such as mining pool name, mining pool domain name, country, number of miners, computing power value, etc. The web crawler can use Puppeteer to simulate the browser, and perform keyword crawling on the commonly used social software twitter / reddit for mining. Manual information can be shared with friends and the latest mining pool can be updated. Automatic collection uses Scrapy or selenium to collect the latest mining pool address, and data can be crawled from common mining pool integration websites.

[0096] DNS / RADIUS log collector obtains the image of DNS protocol and RADIUS protocol, collects DNS traffic logs in real time, and collects RADIUS user access logs.

[0097] The collector can customize the time period for monitoring and operation to prevent problems caused by inaccurate mining pool identification due to outdated data.

[0098] Furthermore, the data is stored properly to improve the performance of subsequent analysis / use

[0099] (2) Data storage:

[0100] Considering the structured nature of mining pool addresses, using a relational database such as PostgreSQL or MySQL can effectively manage structured data and provide powerful data manipulation capabilities through SQL queries.

[0101] For DNS log databases and RADIUS log databases, since they usually involve a large number of write operations (a certain column) and log data, full storage can use columnar database systems for big data processing (such as Clickhouse) because they can provide high-throughput write operations and horizontal scalability.

[0102] Furthermore, the data is processed to make more efficient use of the original data.

[0103] (3) Data processing

[0104] Create two processors for mining pool data labeling and log normalization to clean mining pool data and log data respectively.

[0105] The mining pool data is labeled, including the mining efficiency, computing power distribution, recent block rewards, etc. of each mining pool. The collected data is labeled for the mining pool (mining pool domain name, mining pool ID), as follows: (mining pool 1, 1), (mining pool 2, 2), that is, the labeled label represents the unique identification ID of the mining pool, which is used to distinguish different mining pools and improve the association efficiency.

[0106] Backfilling of RADIUS user access log and DNS traffic log: DNS traffic log only contains request IP, but no broadband user information. It is necessary to match it according to the online information of the user in RADIUS user access log. It requires the use of IP, port, time, domain name in DNS traffic log, and user account, account corresponding IP, and time in RADIUS user access log.

[0107] Based on the backfilled logs, the domain name of the DNS traffic log is judged to form a sequence. The sequence consists of three parts: user name, hour (indicating every hour), mining pool ID, and number of visits.

[0108] (4) Feature processing

[0109] In terms of feature processing, a refined three-stage life cycle is introduced to ensure that the system always maintains a leading position in the accuracy and adaptability of mining behavior recognition, namely feature detector initialization, feature storage and labeling, and feature detector self-evolution:

[0110] Initialization of the feature detector: At the program startup stage, the feature detector is responsible for capturing mining-related traffic features from non-encrypted traffic. Traffic features include: request IP and port: used to determine the target of the traffic; packet size and number: may indicate specific mining activities; domain name information: whether it matches a known mining pool domain name; encryption / non-encryption flag: whether the traffic is encrypted, which may indicate different mining tools and methods. These features are processed and classified in detail. This process ensures that the system can identify the core features of cryptocurrency mining activities from the beginning, laying the foundation for subsequent analysis.

[0111] Use Bisecting k-means (binary k-means) and GMM (Gaussian mixture model) models, and automatically run the result data based on the preprocessed data and the mixed model results.

[0112] (a) Bisecting k-means: This model is used to cluster users’ traffic data and output clustering results to divide users into different groups, such as suspected mining users and non-mining users.

[0113] (b) GMM: The GMM model further performs probability analysis on these clustering results, calculates the probability of each user belonging to a specific mining activity, and outputs the probability distribution result.

[0114] Taking one day's data as test data, since most users are non-miners, if the data of all users throughout the day are classified, there may be a large deviation, so the training data is adjusted and some users without feature data are deleted. The final feature data is as follows: "[a1, a2, a3, a4, a5, a6... a24]" where a1 represents the number of visits to the mining pool from 0 o'clock to 1 o'clock, and so on.

[0115] At the same time, we use the human experience knowledge base to process the known mining traffic and further refine the feature classification. Human intervention not only improves the initial accuracy of feature classification, but also provides standardized training data for machine learning algorithms.

[0116] Feature storage and labeling: The processed features will be stored in a well-designed database with corresponding labels. For example, different mining pools / currencies will be labeled with ETH, BTC, XMR, etc., and traffic will be classified for subsequent feature self-evolution.

[0117] Features include: request IP and port: used to determine the destination of the traffic; packet size and number: may indicate specific mining activities; domain name information: whether it matches a known mining pool domain name, etc. Encryption / non-encryption flag: whether the traffic is encrypted, which may indicate different mining tools and methods.

[0118] Labels are determined based on:

[0119] (a) Mining pool information: Based on the previously collected mining pool information database, the domain name or IP is matched with the known mining pool and labeled according to the currency it belongs to (such as ETH, BTC, XMR, etc.).

[0120] (b) Traffic pattern matching: Cluster analysis of traffic features is performed through machine learning models (such as Bisecting k-means, GMM), and similar traffic patterns are classified under the same label. For example, if a traffic pattern is similar to the known traffic pattern of the Ethereum mining pool, it can be labeled "ETH".

[0121] (c) Behavioral feature analysis: Based on behavioral features such as access frequency and time distribution, users’ mining activities are classified into different currency labels.

[0122] When the system enters the stable operation stage, the feature detector will start the self-evolution mechanism. Through continuous machine learning and algorithm optimization, the system can automatically identify new mining behavior features and continuously improve the recognition mode of existing features. This self-evolution capability ensures that the system can adaptively update its recognition capabilities as mining behavior evolves and becomes more complex, thereby maintaining high efficiency and accuracy in a dynamic network environment.

[0123] Through this lifecycle design, the feature processing module not only has strong data processing and classification capabilities in the initial stage, but also can continuously improve the overall performance of the system through self-learning and evolution over time. This ensures that the mining behavior detection system can always maintain its advancement and effectiveness in the face of ever-changing network threats.

[0124] (5) Mining pool identification

[0125] There are three ways to identify mining pools:

[0126] For non-encrypted traffic, if the connecting domain name is a suspected mining pool domain name, it will be identified as mining pool traffic and its features will be put into the feature processor for processing.

[0127] For non-encrypted traffic, the connection domain name is not a mining pool domain name. At this time, the feature processor can be used to compare the training results of the Bisecting K-means and Gaussian Mixture Model models to determine whether the traffic characteristics are mining characteristics. If so, it is identified as mining pool traffic, and the feature detector evolves automatically.

[0128] For encrypted traffic, the feature processor is used to determine traffic characteristics and feed them back to the feature detector for self-evolution.

[0129] In summary, the present invention presents an advanced network monitoring framework designed for accurate identification of cryptocurrency mining activities. By combining five modules: collector, data storage, data processing, feature processing, and mining pool identification, the system can efficiently collect and process network data. Using technologies such as web crawlers, relational and column databases, and machine learning algorithms (including Bisecting k-means and Gaussian Mixture Model), the system performs in-depth analysis and feature extraction of data. The feature processing module continuously evolves itself throughout the life cycle of the system to adapt to the dynamic changes in network behavior. Such modular design and automated processing ensure the accuracy and reliability of the system in detecting mining behavior.

[0130] It should be noted that the above five key modules work together to provide an efficient and automated mining behavior monitoring mechanism. Each module defines a fixed "input" and "output", and the internal processing method can be treated as a black box, achieving high customization and modularization.

[0131] In another specific embodiment, Figure 3 As shown in the figure, the method for identifying cryptocurrency miners includes the following steps: using Puppeteer or crawlers to obtain the domain name information of the entire network mining pool, and using mirrors to obtain the full DNS / RADIUS logs; using efficient methods to process data, labeling mining pool data, and normalizing DNS / RADIUS logs to improve data utilization efficiency; extracting feature models, applying Bisecting k-means and Gaussian Mixture Model algorithms for data clustering; labeling and storing features, and continuously circulating the latest traffic to optimize feature data; using mining pool discriminators to accurately judge the benchmark identification of mining traffic or features.

[0132] It should be noted that in order to detect and identify cryptocurrency miners, the present invention proposes a method for identifying cryptocurrency miners, which automatically collects mining pool information, generates effective features of users accessing mining pools, and innovatively realizes the automatic extraction and update of miner features by using a hybrid model that is mutually correlated. Using the Bisecting k-means and GaussianMixture Model models, the result data is automatically run out based on the preprocessed data and the hybrid model results. Compared with the prior art, the present invention adopts advanced data analysis methods, and effectively overcomes the low efficiency and accuracy problems of traditional technologies in identifying crypto mining traffic by analyzing traffic characteristics rather than content. This method excels in real-time, accuracy, and robustness, and has low false alarm and omission rates.

[0133] The method for identifying cryptocurrency miners provided by the embodiment of the present invention first obtains the domain name system DNS traffic log and the remote authentication dial-in user service RADIUS user access log; and uses a feature detector to obtain the traffic characteristics of the target user's target traffic from the DNS traffic log and the RADIUS user access log, and the traffic characteristics include requesting Internet Protocol IP and port, data packet size and number, domain name information, and encryption / non-encryption flag; then in response to the target traffic being encrypted traffic, the traffic characteristics are input into the trained mining traffic identification model to obtain an identification result of whether the target traffic is a mining pool traffic; and in response to the target traffic being a mining pool traffic, the target user is identified as a cryptocurrency miner. The present invention effectively overcomes the low efficiency and accuracy problems of traditional technologies in identifying encrypted mining traffic by analyzing traffic characteristics rather than traffic content. The method performs well in real-time, accuracy and robustness, and has a low false alarm rate and false negative rate, which can effectively avoid false access situations and improve the accuracy of mining traffic identification. This solves the problem that the existing method of discovering miners is mainly achieved by identifying traffic content, but since mining traffic is mostly encrypted traffic, direct traffic content identification has the problems of low efficiency and low accuracy.

[0134] Embodiment 2:

[0135] like Figure 4 As shown, this embodiment provides a device for identifying cryptocurrency miners, which is used to execute the above-mentioned method for identifying cryptocurrency miners, including:

[0136] The log data acquisition module 11 is used to acquire the domain name system DNS traffic log and the remote authentication dial-in user service RADIUS user access log;

[0137] A traffic feature acquisition module 12, connected to the log data acquisition module 11, is used to obtain traffic features of target user target traffic from the DNS traffic log and RADIUS user access log using a feature detector, wherein the traffic features include request Internet Protocol IP and port, data packet size and quantity, domain name information, and encryption / non-encryption flag;

[0138] A mining pool flow identification module 13 is connected to the flow feature acquisition module 12, and is used for inputting the flow feature into a trained mining flow identification model in response to the target flow being encrypted flow, to obtain an identification result of whether the target flow is mining pool flow;

[0139] The cryptocurrency miner identification module 14 is connected to the mining pool traffic identification module 13, and is used to identify the target user as a cryptocurrency miner in response to the target traffic being mining pool traffic.

[0140] Optionally, the log data acquisition module 11 includes:

[0141] An image acquisition unit, used for acquiring an image of a DNS protocol and an image of a RADIUS protocol;

[0142] The log collection unit is used to collect DNS traffic logs and RADIUS user access logs in real time according to the mirror image of the DNS protocol and the mirror image of the RADIUS protocol.

[0143] Optionally, the device further comprises:

[0144] Data collection module, used to collect mining pool data, historical DNS traffic logs, and historical RADIUS user access logs;

[0145] A data processing module, used for marking the mining pool data and normalizing the historical DNS traffic log and the historical RADIUS user access log;

[0146] A training set acquisition module is used to acquire traffic feature training data and corresponding labels based on the labeled mining pool data and the normalized historical DNS traffic logs and historical RADIUS user access logs;

[0147] The model training module is used to train the mining traffic identification model using traffic feature training data and corresponding labels to obtain the trained mining traffic identification model.

[0148] Optionally, the device further comprises:

[0149] A first storage module, used for storing the mining pool data using a relational database;

[0150] The second storage module is used to store the historical DNS traffic log and the historical RADIUS user access log by using a column database.

[0151] Optionally, the mining traffic identification model includes a bisection K-means model and a Gaussian mixture model GMM model; the mining pool traffic identification module 13 includes:

[0152] A clustering unit, used for inputting the traffic features into a Bisecting K-means model, so that the Bisecting K-means model clusters the traffic features to obtain a clustering result;

[0153] A probability distribution unit, configured to perform probability analysis on the clustering result using the GMM model, obtain a probability of whether the target traffic belongs to a specific mining activity, and output a probability distribution result;

[0154] A result identification unit is used to obtain an identification result of whether the target flow is a mining pool flow according to the probability distribution result.

[0155] Optionally, the device further comprises:

[0156] A first identification module, configured to identify the target traffic as mining pool traffic in response to the target traffic being non-encrypted traffic and the connection domain name being a suspected mining pool domain name;

[0157] The second identification module is used to determine whether the target traffic is mining pool traffic by using the trained mining traffic identification model in response to the target traffic being non-encrypted traffic and the connection domain name being not a mining pool domain name.

[0158] Optionally, the device further comprises:

[0159] The self-evolution module is used to feed back the recognition result of the target flow to the feature device so that the feature device can self-evolve.

[0160] Embodiment 3:

[0161] refer to Figure 5 This embodiment provides a device for identifying cryptocurrency miners, including a memory 21 and a processor 22. The memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the method for identifying cryptocurrency miners in Example 1.

[0162] The memory 21 is connected to the processor 22. The memory 21 may be a flash memory, a read-only memory or other memory. The processor 22 may be a central processing unit or a single-chip microcomputer.

[0163] Embodiment 4:

[0164] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method for identifying cryptocurrency miners in the above-mentioned embodiment 1 is implemented.

[0165] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0166] In summary, the method, device and readable storage medium for identifying cryptocurrency miners provided by the embodiment of the present invention first obtain the domain name system DNS traffic log and the remote authentication dial-in user service RADIUS user access log; and use the feature device to obtain the traffic characteristics of the target user's target traffic from the DNS traffic log and the RADIUS user access log, and the traffic characteristics include the requested Internet Protocol IP and port, the size and number of data packets, domain name information, and the encryption / non-encryption flag; then in response to the target traffic being encrypted traffic, the traffic characteristics are input into the trained mining traffic identification model to obtain the identification result of whether the target traffic is a mining pool traffic; and in response to the target traffic being a mining pool traffic, the target user is identified as a cryptocurrency miner. The present invention effectively overcomes the low efficiency and accuracy problems of traditional technologies in identifying encrypted mining traffic by analyzing traffic characteristics rather than traffic content. The method performs well in real-time, accuracy and robustness, and has a low false alarm rate and false negative rate, which can effectively avoid false access situations and improve the accuracy of mining traffic identification. This solves the problem that the existing method of discovering miners is mainly achieved by identifying traffic content, but since mining traffic is mostly encrypted traffic, direct traffic content identification has the problems of low efficiency and low accuracy.

[0167] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying cryptocurrency miners, characterized in that: The method comprises: Obtain Domain Name System (DNS) traffic logs and Remote Authentication Dial-In User Service (RADIUS) user access logs; Using a characterizer to obtain traffic characteristics of target user target traffic from the DNS traffic log and the RADIUS user access log, the traffic characteristics including request Internet Protocol IP and port, data packet size and quantity, domain name information, and encryption / non-encryption flag; In response to the target traffic being encrypted traffic, inputting the traffic feature into a trained mining traffic identification model to obtain an identification result of whether the target traffic is mining pool traffic; In response to the target traffic being mining pool traffic, the target user is identified as a cryptocurrency miner.

2. The method according to claim 1, characterized in that The obtaining of the domain name system DNS traffic log and the remote authentication dial-in user service RADIUS user access log specifically includes: Get the DNS protocol image and the RADIUS protocol image; According to the mirror image of the DNS protocol and the mirror image of the RADIUS protocol, the DNS traffic log and the RADIUS user access log are collected in real time.

3. The method according to claim 1, characterized in that Before inputting the traffic feature into the trained mining traffic identification model to obtain an identification result of whether the target traffic is mining pool traffic, the method further includes: Collect mining pool data, historical DNS traffic logs, and historical RADIUS user access logs; Marking the mining pool data, and normalizing the historical DNS traffic logs and historical RADIUS user access logs; Obtaining traffic feature training data and corresponding labels based on the labeled mining pool data and the normalized historical DNS traffic logs and historical RADIUS user access logs; The mining traffic identification model is trained using traffic feature training data and corresponding labels to obtain the trained mining traffic identification model.

4. The method according to claim 3, characterized in that: After collecting the mining pool data, historical DNS traffic logs, and historical RADIUS user access logs, the method further includes: Using a relational database to store the mining pool data; A column-based database is used to store the historical DNS traffic logs and historical RADIUS user access logs.

5. The method according to claim 1, characterized in that The mining traffic identification model includes a bisection K-means model and a Gaussian mixture model GMM model; the traffic feature is input into the trained mining traffic identification model to obtain an identification result of whether the target traffic is a mining pool traffic, specifically including: Inputting the traffic features into a Bisecting K-means model so that the Bisecting K-means model clusters the traffic features to obtain a clustering result; Use the GMM model to perform probability analysis on the clustering results, obtain the probability of whether the target traffic belongs to a specific mining activity, and output a probability distribution result; An identification result of whether the target flow is a mining pool flow is obtained according to the probability distribution result.

6. The method according to claim 1, characterized in that The method further comprises: In response to the target traffic being non-encrypted traffic and the connecting domain name being a suspected mining pool domain name, identifying the target traffic as mining pool traffic; In response to the target traffic being non-encrypted traffic and the connection domain name being not a mining pool domain name, whether the target traffic is mining pool traffic is determined by using the trained mining traffic identification model.

7. The method according to claim 1, characterized in that The method further comprises: The identification result of the target flow is fed back to the feature device so that the feature device can self-evolve.

8. A device for identifying cryptocurrency miners, characterized in that: The device comprises: Log data acquisition module, used to obtain domain name system DNS traffic logs and remote authentication dial-in user service RADIUS user access logs; A traffic feature acquisition module, connected to the log data acquisition module, for acquiring traffic features of target user target traffic from the DNS traffic log and the RADIUS user access log using a feature detector, wherein the traffic features include request Internet Protocol IP and port, data packet size and quantity, domain name information, and encryption / non-encryption flag; A mining pool flow identification module, connected to the flow feature acquisition module, for inputting the flow feature into a trained mining flow identification model in response to the target flow being encrypted flow, to obtain an identification result of whether the target flow is mining pool flow; The cryptocurrency miner identification module is connected to the mining pool traffic identification module and is used to identify the target user as a cryptocurrency miner in response to the target traffic being mining pool traffic.

9. A device for identifying cryptocurrency miners, characterized in that: It includes a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the method for identifying a cryptocurrency miner as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the method for identifying cryptocurrency miners as described in any one of claims 1-7.

Images