Real-time TLS encryption active mining flow monitoring method

Abstract

The invention provides a real-time TLS encryption active mining flow monitoring method. The method comprises the following steps: acquiring TLS flow data in real time; based on a pre-established TLS detection algorithm, determining active mining flow according to the TLS flow data; wherein the active mining flow is determined based on a pre-established TLS detection algorithm and according to the TLS flow data, and the method comprises the following steps: extracting a bidirectional TLS flow by using the pre-established TLS detection algorithm, and filtering out non-TLS flow; processing the length and direction information of the continuously received data packets based on a pre-established feature extraction algorithm, dynamically adjusting a key value, and performing state conversion and feature extraction; and through a pre-trained machine learning XGBoost model, classifying the encrypted mining flow, and determining the active mining flow. The monitoring precision and the response speed of the encrypted currency mining behavior are effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain network, in particular, to a real-time TLS encryption active mining flow monitoring method. BACKGROUND

[0002] The current detection of active mining behavior mainly relies on the mining pool blacklist mechanism, and its effectiveness depends on the accuracy and timeliness of the blacklist. However, this detection method is facing three serious challenges: first, the hidden mining pool uses domain names without features, frequently changes nodes, and other ways to evade detection, making it difficult to update the blacklist in time, resulting in a detection gap before new mining pool nodes are included; second, the popularity of encrypted communication makes traditional plaintext flow detection methods ineffective, and the original deep packet inspection technology is basically helpless in the TLS encryption scenario; finally, the existing machine learning detection method is limited in feature extraction under encrypted traffic, and the widespread use of proxy mining pools and private mining pools further exacerbates the lag of threat intelligence updates. These factors together have led to the current detection mechanism in the face of new mining behavior to appear the dual dilemma of high false positives and high false negatives, which seriously restricts the effectiveness of regulation, and a more reliable detection method is needed to solve this problem. SUMMARY

[0003] Therefore, the purpose of the present application is to provide a real-time TLS encryption active mining flow monitoring method, which can effectively improve the monitoring accuracy and response speed of cryptocurrency mining behavior, adapt to multiple scene requirements, and provide reliable technical support for network security regulation.

[0004] The embodiment of the present application provides a real-time TLS encryption active mining flow monitoring method, which comprises:

[0005] Real-time acquisition of TLS flow data;

[0006] Based on the pre-established TLS detection algorithm, the active mining flow is determined according to the TLS flow data;

[0007] Among them, based on the pre-established TLS detection algorithm, the active mining flow is determined according to the TLS flow data, which comprises:

[0008] Extracting bidirectional TLS flow by using the pre-established TLS detection algorithm, and filtering out non-TLS flow;

[0009] Based on the pre-established feature extraction algorithm, the length and direction information of the continuously received data packets are processed, and the key value is dynamically adjusted for state conversion and feature extraction;

[0010] Through the pre-trained machine learning XGBoost model, the encrypted mining flow is classified to determine the active mining flow.

[0011] In some embodiments, the real-time TLS stream data is acquired, including:

[0012] Bidirectional traffic data is captured through a network interface, covering inbound and outbound packets, to ensure that complete network communication records are collected.

[0013] In some embodiments, the method further includes:

[0014] The TLS stream data is parsed, IP layer and transport layer data are extracted, and non-TLS traffic is filtered;

[0015] A five-tuple is used to uniquely identify a bidirectional TLS session, and is marked as 1 based on the direction of the first packet, and the reverse direction traffic is automatically merged and marked as -1;

[0016] A hash table is used to achieve traffic matching with time complexity, storing three key fields of packet length, timestamp, and direction identification.

[0017] In some embodiments, the continuously received packet length and direction information are processed based on a pre-established feature extraction algorithm, and the key values are dynamically adjusted, including the steps of state conversion and feature extraction:

[0018] The constructed bidirectional TLS stream hash table is used as input, and the data traffic packets are arranged in timestamp order, so that each packet is associated with a set time point, and the total number of packets, the total number of bytes, and the average packet length are extracted by statistical calculation on the time sequence distribution, length distribution, and direction distribution of the packets in the stream;

[0019] Based on the pre-established feature extraction algorithm, a hash table set is maintained to store and update the key feature values, including the number of forward task packets, the number of reverse task packets, the number of forward submission packets, the number of reverse submission packets, and the number of cycles that meet the loop, and the key feature values are dynamically adjusted for state conversion and feature extraction.

[0020] The key feature values include the number of forward task packets, the number of reverse task packets, the number of forward submission packets, the number of reverse submission packets, and the number of cycles that meet the loop.

[0021] In some embodiments, the machine learning XGBoost model is trained by the following steps:

[0022] The labeled traffic data is obtained;

[0023] The machine learning XGBoost model is trained using the labeled traffic data to identify the feature patterns of encrypted mining traffic;

[0024] The method includes:

[0025] According to the extracted feature tuple input model and the classification result of the pre-trained machine learning XGBoost model, it is judged whether there is a mining behavior of encryption.

[0026] In some embodiments, the machine learning XGBoost model adopts a loss function as an optimization target of the machine learning XGBoost model, and the formula of the loss function is:

[0027]

[0028] Wherein, y i is the true label, p i is the model prediction probability, and N is the sample number.

[0029] In some embodiments, the method further comprises:

[0030] The accuracy Accuracy, precision Precision, recall Recall and F1-Score are used to determine the performance of the pre-established TLS detection algorithm.

[0031] Wherein, the accuracy Accuracy represents the proportion of samples predicted correctly by the model in the total samples; the precision Precision represents the proportion of samples actually positive in the samples predicted by the model as positive; the recall Recall represents the proportion of samples correctly predicted by the model as positive in the samples actually positive; and the F1-Score represents the proportion of samples correctly predicted by the model as positive in the samples actually positive.

[0032] Wherein, the accuracy Accuracy is calculated by the following formula:

[0033]

[0034] Wherein, TP(True Positive) represents true positive, that is, the number of samples actually positive and correctly identified by the model as positive; FP(False Positive) represents false positive, that is, the number of samples actually negative but incorrectly identified by the model as positive; TN(True Negative) represents true negative, that is, the number of samples actually negative and correctly identified by the model as negative; and FN(False Negative) represents false negative, that is, the number of samples actually positive but incorrectly identified by the model as negative.

[0035] In some embodiments, the precision Precision is calculated by the following formula:

[0036]

[0037] wherein, TP (True Positive) represents true positive, i.e. the number of samples that are actually positive and are correctly identified as positive by the model; and FP (False Positive) represents false positive, i.e. the number of samples that are actually negative but are incorrectly identified as positive by the model.

[0038] In some embodiments, the recall Recall is calculated by the following formula:

[0039]

[0040] wherein, TP (True Positive) represents true positive, i.e. the number of samples that are actually positive and are correctly identified as positive by the model; and FN (False Negative) represents false negative, i.e. the number of samples that are actually positive but are incorrectly identified as negative by the model.

[0041] In some embodiments, the F1-Score is calculated by the following formula:

[0042]

[0043] wherein, Precision represents precision.

[0044] The real-time TLS encryption active mining flow monitoring method provided by the embodiments of the present application can effectively improve the monitoring accuracy and response speed of the cryptocurrency mining behavior, adapt to multiple scene requirements, and provide reliable technical support for network security supervision.

[0045] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the following preferred embodiments are specifically described below, and the accompanying drawings are described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0047] Figure 1 A flowchart of a real-time TLS encryption active mining flow monitoring method provided by the embodiments of the present application;

[0048] Figure 2 A classification diagram of an existing mining detection method provided by the embodiments of the present application;

[0049] Figure 3A schematic diagram of a real-time TLS encryption active mining flow detection framework provided by an embodiment of the present application is shown in FIG. 1.

[0050] Figure 4 A client and server information flow diagram provided by an embodiment of the present application is shown in FIG. 2.

[0051] Figure 5 A flowchart of an encrypted mining flow detection system provided by an embodiment of the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions of the embodiments of the present application will be described below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. The components of the embodiments of the present application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, every other embodiment obtained by a person skilled in the art without creative work falls within the scope of the present application.

[0053] First, the application scenarios applicable to the present application are introduced. The present application can be applied to the field of blockchain network technology.

[0054] Cryptocurrency mining verifies blockchain transactions by solving a set of cryptographic puzzles using high-performance computing devices and obtains block rewards in return. This mechanism not only maintains the security of the decentralized network, but also provides economic incentives for participants. However, its energy consumption problem is increasingly prominent, and the huge demand for electricity leads to environmental pollution and overconsumption of natural resources worldwide, causing continuous pressure on the ecosystem. In view of these negative impacts, many governments have introduced relevant restrictions, and even completely banned related activities. In addition, mining behavior has the characteristics of high concealment and diversity, including both active mining by insiders and passive mining induced by external attacks. This dual characteristic makes mining detection a key direction of network security research.

[0055] The rapid development of cryptocurrency mining activities has made illegal mining behavior detection an important topic in the field of network security.

[0056] Specifically, please refer to Figure 2 , Figure 2 A classification diagram of existing mining detection methods provided by an embodiment of the present application is shown in FIG. 4.

[0057] As Figure 2As shown, existing research focuses on encrypted hijacking detection, mainly divided into the following categories.

[0058] I. Passive mining detection based on browsers

[0059] Passive mining detection based on browsers can be divided into static analysis and dynamic analysis:

[0060] Static analysis: By extracting the static features of JS or WebAssembly code (such as heap snapshots, stack code), combined with a malicious sample library to achieve recognition, typical applications include blacklist matching, fusion algorithm to build detection models, and browser extension tools (such as NoCoin). Its characteristics are high detection efficiency, but it is easy to be evaded by code obfuscation techniques (such as Tigress tools), and its robustness is insufficient.

[0061] Dynamic analysis: By monitoring the API call sequence, CPU occupancy, network traffic, and other dynamic features during program execution, a detection model is built using machine learning to deal with complex encrypted hijacking behavior. However, this method relies on the hardware environment and operating system, and has poor generalization performance and cross-platform migration, such as being affected by hardware noise or unstable detection results in environments with large resource differences.

[0062] II. Passive mining detection based on malware

[0063] Passive mining detection based on malware also includes static analysis and dynamic analysis:

[0064] Static analysis: Using the inherent properties of mining malware (such as PE file block information, opcode sequence), directly detecting static files without running samples, has high efficiency. However, it is difficult to resist hidden dynamic link library calls, code obfuscation, and shell bypass techniques.

[0065] Dynamic analysis: Execute mining malware in a controlled environment, analyze its runtime system calls, performance indicators, and other features, which are not easily bypassed by attackers. However, there are problems such as poor timeliness of detection (waiting for system performance to be affected), susceptibility to hardware environment noise interference, and weak generalization performance.

[0066] III. Mining detection based on network traffic

[0067] Mining detection based on network traffic belongs to dynamic analysis, its core is to capture the traffic on the Internet gateway, extract features and input them into a machine learning model to achieve classification, without the need to install software on user terminals. The mainstream of cryptocurrencies relies on the Stratum protocol to communicate between miners and mining pools, providing a basis for traffic analysis. However, this method is subject to encryption of the transport layer security protocol, and has limited large-scale detection capabilities.

[0068] There are at least the following technical problems in the prior art: static analysis method is difficult to resist code obfuscation; dynamic analysis method performs poorly in detection and timeliness, and has the problem of insufficient generalization performance; network traffic analysis method is limited by TLS encryption, and has limited large-scale detection capability; domestic and foreign research on cryptocurrency mining detection mostly focuses on the identification of encryption hijacking behavior, and less attention is paid to active mining behavior. In particular, for the detection of active mining behavior using high-performance computing resources such as servers, there is currently no mature solution.

[0069] Currently, the detection of active mining behavior mainly relies on the mining pool blacklist mechanism, and the effectiveness of which lies in the accuracy and timeliness of the blacklist. However, this detection method is facing three serious challenges:

[0070] Firstly, the hidden mining pool evades detection by using non-feature domain names and frequently changing nodes, making it difficult for the blacklist to be updated in time, resulting in a detection gap before new mining pool nodes are included.

[0071] Secondly, the popularity of encrypted communication makes traditional plaintext traffic detection methods ineffective, and the original deep packet inspection technology is basically powerless in the TLS encryption scenario.

[0072] Finally, the feature extraction of existing machine learning detection methods is limited under encrypted traffic, and the widespread use of proxy mining pools and private mining pools further exacerbates the lag in threat intelligence updates.

[0073] These factors together cause the current detection mechanism to fall into the double dilemma of high false positives and high false negatives when dealing with new mining behaviors, severely restricting the effectiveness of regulation, and there is an urgent need to research more reliable detection methods to solve this problem.

[0074] The prior art also includes the following technical problems: encrypted traffic detection is difficult: TLS encryption makes traditional plaintext features ineffective, and existing machine learning models cannot efficiently extract mining behavior features from encrypted traffic; insufficient generalization ability: passive mining detection relies on hardware environment, and the model performance significantly decreases under different devices or mining scripts; poor real-time performance: dynamic analysis needs to wait for a long time for mining behavior to trigger detection, resulting in an increased false negative rate; feature limitation: static analysis is easily evaded by obfuscation techniques, dynamic analysis is sensitive to system resource occupation, and it is difficult to capture short-term anomalies.

[0075] Based on this, the embodiments of the present application provide a real-time TLS encrypted active mining traffic monitoring method, which can effectively improve the monitoring accuracy and response speed of cryptocurrency mining behavior, adapt to multiple scene requirements, and provide reliable technical support for network security regulation.

[0076] In a first aspect, please refer to Figure 1 ,Figure 1 A flowchart of a real-time TLS encrypted active mining flow monitoring method provided by an embodiment of the application is shown in FIG. 1. As shown in FIG. 1, the real-time TLS encrypted active mining flow monitoring method provided by the embodiment of the application comprises the following steps. Figure 1

[0077] S101, acquiring TLS flow data in real time.

[0078] S102, determining active mining flow based on a pre-established TLS detection algorithm and the TLS flow data.

[0079] In the step S102, determining active mining flow based on the pre-established TLS detection algorithm and the TLS flow data comprises the following steps.

[0080] extracting bidirectional TLS flow by using the pre-established TLS detection algorithm, and filtering out non-TLS flow;

[0081] processing the continuously received packet length and direction information based on a pre-established feature extraction algorithm, and dynamically adjusting the key value to perform state conversion and feature extraction;

[0082] classifying the encrypted mining flow by using a pre-trained machine learning XGBoost model, and determining the active mining flow.

[0083] Currently, the classification schemes for encrypted flow mainly include packet-level and flow-level categories, each of which is adapted to different application scenarios and has unique advantages and limitations.

[0084] The packet-level classification scheme focuses on identifying flow based on the features of a single packet. This method usually extracts static features of the packet, such as packet length, arrival time interval, protocol type, etc., to distinguish various types of flow. The significant advantage of this method is its high processing efficiency and low storage requirement, as it only needs to analyze a single packet to complete the classification task. However, the limitation of packet-level classification is that it cannot fully utilize the context information of communication, resulting in a significant decrease in classification accuracy when faced with complex encrypted flow, especially when the packet features are similar or the obfuscation means are strong.

[0085] The flow-level classification scheme focuses on analyzing the features of a complete communication flow. This method extracts flow-level statistical features, such as flow duration, total packet number, total byte number, packet length distribution, and arrival time sequence, to identify flow types. The core advantage of flow-level classification is that it can fully capture the overall behavior pattern of the communication flow, thereby exhibiting strong recognition ability when faced with complex encrypted flow. Although flow-level classification has high computational and storage overhead, and it is difficult to complete classification quickly at the beginning of communication, its performance in accuracy makes it an important means for handling complex flow. ​

[0086] To better achieve the detection of encrypted mining traffic, this section adopts flow-level features as the main analysis method. This choice not only effectively captures the behavior patterns of encrypted mining traffic, but also overcomes the limitations of packet-level classification in complex scenarios, thereby improving the accuracy and reliability of detection.

[0087] As an example, a bidirectional TLS flow is shown in the following table:

[0088]

[0089]

[0090] The bidirectional TLS flow construction algorithm proposed in this section efficiently extracts and analyzes TLS sessions in network traffic through hierarchical processing and lightweight storage technology. The pseudo code is divided into two main steps: first, in step one, by parsing the input traffic and extracting IP layer and transport layer data, the pseudo code lines 1-9 quickly filter non-TLS traffic, significantly reducing the subsequent computational overhead, thereby improving the inference speed and throughput of the system; second, in step two, the pseudo code lines 10-20 use five-tuple (source IP, destination IP, source port, destination port, protocol number) to uniquely identify bidirectional TLS sessions, and mark 1 based on the direction of the first packet, and automatically merge the reverse direction traffic marked as -1, while preserving the original timestamp to ensure the accuracy of the timing analysis. Through the hash table, the traffic matching has a time complexity of O(n), and only three key fields, packet length, timestamp and direction identifier, are stored, which greatly reduces the space complexity and supports real-time detection and large-scale data analysis.

[0091] Among them, the real-time acquisition of TLS flow data includes: capturing bidirectional flow data through the network interface, covering inbound and outbound packets, to ensure that complete network communication records are collected.

[0092] Optionally, the method further comprises:

[0093] Parsing the TLS flow data, extracting the IP layer and transport layer data, and filtering non-TLS traffic;

[0094] Using five-tuple to uniquely identify bidirectional TLS sessions, and marking 1 based on the direction of the first packet, and automatically merging the reverse direction traffic marked as -1;

[0095] Through the hash table, the traffic matching has a time complexity of O(n), and only three key fields, packet length, timestamp and direction identifier, are stored.

[0096] Specifically, based on the pre-established feature extraction algorithm, the length and direction information of the continuously received packets are processed, and the key values are dynamically adjusted, including the steps of state conversion and feature extraction:

[0097] The constructed bidirectional TLS stream hash table is taken as input, the data flow packets are arranged in timestamp order, each data packet is associated with a set time point, and the total number of data packets, the total number of bytes, and the average packet length are extracted by statistical calculation of the time sequence distribution, length distribution, and direction distribution of the data packets in the stream.

[0098] Based on the pre-established feature extraction algorithm, a hash table set is maintained to store and update the key feature values, including the number of forward task packets, the number of reverse task packets, the number of forward submission packets, the number of reverse submission packets, and the number of cycles satisfying the loop, and the key feature values are dynamically adjusted for state conversion and feature extraction.

[0099] The key feature values include the number of forward task packets, the number of reverse task packets, the number of forward submission packets, the number of reverse submission packets, and the number of cycles satisfying the loop.

[0100] Here, after completing the first stage of constructing bidirectional TLS streams, the original PCAP packets are constructed into a hash table, and the unique identifier of the bidirectional stream (source IP, destination IP, source port, destination port, protocol number) is taken as the key value, and the packet length, timestamp, and direction are stored as Values. This lightweight data structure design not only optimizes storage efficiency, but also provides efficient access to the underlying support for subsequent feature extraction.

[0101] The second stage of feature extraction takes the bidirectional TLS stream hash table constructed in the first stage as input, and outputs the feature list corresponding to each stream by statistical analysis of the time sequence and direction information of each stream. This section mainly selects two types of features for model training and traffic classification: traffic statistical features and mining packet loop features.

[0102] Traffic statistical features only rely on basic information such as packet length, timestamp, and direction, do not need to parse encrypted payloads, have low computational overhead, and are suitable for large-scale network traffic analysis requirements. Even in high-throughput environments, feature extraction can be quickly completed to meet real-time detection requirements. In the hash table stored in the first stage, the data flow packets are arranged in timestamp order, each data packet is associated with a set time point, and the following features are extracted by statistical calculation of the time sequence distribution, length distribution, and direction distribution of the data packets in the stream: total number of data packets, total number of bytes, and average packet length.

[0103] The mining packet circulation feature is a unique feature extracted specifically for the behavior pattern of encrypted mining traffic. Although the communication content of encrypted mining traffic is encrypted, its communication pattern often exhibits relatively fixed characteristics, which makes its behavior pattern still possible to be effectively identified. Through in-depth analysis, it is found that there are three key data packet circulation relationships in encrypted mining traffic: Job, Submit and Confirm. Whenever these three data packets appear in a set order, it usually means that the attacked device has completed the task assigned by the mining pool. This fixed length and periodic communication pattern provides an important clue for detecting encrypted mining traffic.

[0104] It is worth noting that the Job, Submit and Confirm data packets form the core part of the encrypted hijacking traffic, while other types of data packets (such as login authentication or online status check) usually only appear under certain circumstances. However, due to the fact that the connection of the mining cycle does not strictly follow the "end before start" pattern, it is difficult to accurately identify the specific data packet type by relying solely on the length and direction information of the data packet. In addition, if the entire data stream is traversed from the beginning each time in a real-time detection scenario, it will result in high time complexity, which obviously cannot meet the real-time detection requirements. Therefore, how to design an efficient and accurate identification method has become a key challenge for further optimizing the mining traffic detection model.

[0105] Among them, the feature extraction algorithm is based on the idea of dynamic programming, which maintains a set of hash tables to store and update key feature values, including the number of forward task packets, the number of reverse task packets, the number of forward submission packets, the number of reverse submission packets, and the number of cycles that meet the circulation. This design can process the length and direction information of the data packets received in real time and dynamically adjust the above five key values, thereby realizing state transition and feature extraction. Specifically, this algorithm is mainly used to extract the periodic features of encrypted mining from network traffic, and the core logic is to identify possible mining behavior based on the combination matching of data packet length and transmission direction. The algorithm assumes that the interaction between the mining pool and the miner follows a fixed timing pattern of task packet issuance → calculation → result submission → confirmation.

[0106] First, the algorithm initialization stage will check whether there is a historical statistical cache according to the input three types of packet length (x, y, z). If there is, the corresponding state is restored; otherwise, each counter (xs, dxs, ys, dys, count) is initialized to 0. Then, the algorithm traverses the input data packet length sequence lst and direction sequence directions, and identifies the three stages of mining traffic through packet-by-packet matching:

[0107] (1) Task packet phase (length x): If the data packet length matches x, then the corresponding task packet count (xs or dxs) is accumulated according to the transmission direction (forward represents the task issued by the mining pool, and backward represents the task requested by the miner).

[0108] (2) Submission packet phase (length y): If the data packet length matches y, the precondition (i.e., there is an existing task packet) needs to be met, and the corresponding counter is adjusted. For example, a forward submission packet (d = 1) must be paired with an inventory reverse task packet (dxs > 0), otherwise it is not counted in the statistics, so as to ensure compliance with the mining flow process constraints.

[0109] (3) Confirmation packet phase (length z): Similar to the submission packet phase, the confirmation packet length conforms to z and there is an existing unconsumed submission packet (such as dys or ys), then the complete cycle count (count++) is triggered, confirming that the process complies with the mining process and updating the state.

[0110] Finally, the algorithm updates the cache dictionary and returns the counter results. The algorithm calculates the total number of cycles for three types of packet lengths by maintaining five variables, and reduces the time complexity to O(n) by using the dynamic programming idea to divide the original problem into relatively simple sub-problems. This design enables the algorithm to efficiently identify the mining periodicity under the fixed packet length mode.

[0111] Specifically, the machine learning XGBoost model is trained by the following steps:

[0112] Obtain the labeled traffic data;

[0113] Train through the labeled traffic data to enable the machine learning XGBoost model to identify the feature pattern of encrypted mining traffic.

[0114] The method comprises:

[0115] According to the extracted feature tuple input model and the classification result of the pre-trained machine learning XGBoost model, it is judged whether there is an encrypted mining behavior.

[0116] The machine learning XGBoost model uses a loss function as the optimization objective of the machine learning XGBoost model, and the formula of the loss function is:

[0117]

[0118] Where y i is the true label, p i is the model prediction probability, and N is the number of samples.

[0119] It is worth noting that as one of the core behaviors of the blockchain network, mining communication traffic exhibits significant detectable characteristics in both plaintext and encrypted scenarios. This chapter reveals the key identifiers of mining traffic by analyzing the working mechanism of the Stratum protocol and encrypted traffic packets.

[0120] Among them, the Stratum protocol is a JSON-RPC-based plaintext TCP protocol and the most commonly used communication protocol between miners and mining pools. Compared with early mining protocols such as Getwork, Stratum significantly reduces network latency and bandwidth consumption by optimizing data transmission mechanisms, becoming the mainstream protocol in the current blockchain mining field. The protocol was originally developed for the Electrum Bitcoin wallet to synchronize blocks, transactions, and mining pool-related information in the Bitcoin blockchain. Although different cryptocurrencies have differences in implementation, their communication generally follows similar processes.

[0121] Miners first establish a connection with the mining pool, usually using the Stratum protocol to send authentication requests and apply for mining tasks (step 1). After verifying the miner's identity (step 2), the mining pool assigns a set of mining tasks, usually sending the current block header-related data and the required difficulty level to the miner (step 3). After receiving the task, the miner starts hash calculation based on the provided task data and tries to find a solution that meets the difficulty requirements (step 4). If the miner successfully finds a valid hash value (i.e., a solution), it will submit the result back to the mining pool for verification (step 5). The mining pool verifies the submitted result (step 6). If the hash value meets the requirements, the mining pool will record and confirm the successful mining and reward the miner (step 7). Regardless of success or failure, the miner will receive feedback from the mining pool and continue to receive new mining tasks, repeating the process in subsequent cycles.

[0122] To avoid mining traffic detection based on packet content matching, many mining behaviors use TLS protocol for obfuscation design. Among them, TLS-encrypted Stratum mining traffic is a secure transmission layer protocol-based encrypted communication method designed to achieve efficient and secure data transmission between mining machines and mining pools. In this mode, the core interaction data of the Stratum protocol is encrypted and transmitted through the TLS channel, effectively preventing data from being intercepted or tampered with, thereby improving communication security.

[0123] However, despite the TLS encryption and obfuscation measures that conceal the specific content of the data, miners still need to communicate periodically with the mining pool, especially during the process of uploading their work results. This communication pattern has relatively fixed characteristics, making it possible to identify their behavior patterns even after encryption. By analyzing encrypted mining traffic using the Wireshark tool, it was found that after completing the handshake, the TLS protocol encrypts the subsequent application layer data into "Application Data" packets, which Wireshark cannot directly parse the plaintext content. However, by analyzing the "Length" field of the data packet, it was found that data packets with fixed lengths such as "489", "317", "147" and others appear periodically.

[0124] This fixed-length periodicity provides an important clue for detecting encrypted mining traffic. Even though TLS encryption and obfuscation hide the specific communication content, statistical analysis based on packet length and communication pattern can still effectively identify potential mining behavior. This discovery provides new ideas and methods for detecting and defending against mining traffic.

[0125] Through in-depth analysis of encrypted mining traffic, it can be clearly observed that the mining process is composed of multiple periodic mining cycles. The initial stage of each mining cycle is usually the distribution of task packets by the mining pool, which is highly similar to the task distribution step in the plaintext mining communication process. During the mining cycle, miners find a random number that meets the requirements by calculation and submit the results to the mining pool, which corresponds to the result submission step in the plaintext communication process. Subsequently, the mining pool verifies and feeds back the confirmation based on the results submitted by the miners, similar to the feedback step in the plaintext process.

[0126] It is worth noting that the connection of mining cycles does not strictly follow the "end before start" pattern. Research has found that the mining pool may distribute the task packets of the next task in advance before receiving the submission results of the previous task, which means that the mining pool can issue multiple tasks to miners simultaneously. This parallel task distribution mechanism significantly improves the efficiency of mining, reflecting the optimization strategies of the mining pool in task scheduling and resource utilization. This discovery not only reveals the dynamic characteristics of encrypted mining traffic, but also provides important reference for further analysis and detection of mining behavior.

[0127] Please refer to Figure 3 , real-time detection of mining tasks is performed by extracting unique network traffic packet features of mining tasks. The overall architecture of the model is shown in Figure 3 .

[0128] Specifically, in the active mining detection, firstly, an algorithm for constructing bidirectional TLS flow is designed. Using this algorithm can quickly extract bidirectional TLS flow and filter out non-TLS traffic, thereby significantly reducing the network packets that need to be processed. Secondly, combined with the statistical characteristics and the transmission mode unique to mining traffic, a set of special encrypted traffic mining detection feature set is designed. To improve processing efficiency, a feature extraction algorithm based on dynamic programming is developed to speed up feature extraction. This algorithm stores and updates key feature values by maintaining a set of hash tables, which can process the continuously received packet length and direction information in real time, and dynamically adjust the key values, thereby realizing state transition and feature extraction, meeting the real-time detection requirements. Finally, the encrypted mining traffic is classified by training the machine learning XGBoost model.

[0129] To monitor the mining behavior of enterprise-level devices, the present application provides a separation scheme, which separates the web client from the server. The client is used to receive and display analysis results, while receiving real-time alarm information; the server is responsible for data collection, feature extraction and model training, which ensures efficient collaborative processing of large-scale network traffic and improves overall detection accuracy and response speed. The client can display the monitoring results of multiple servers, and the specific information flow diagram is as shown in Figure 4

[0130] Specifically, the detection results can be received by the web client and the monitoring situation can be displayed. The server deploys a model to capture network traffic and detect whether it is mining traffic. If mining traffic is detected, the server will feed back the relevant information to the client to trigger an alarm.

[0131] As shown in Figure 5 The whole process can be divided into four stages:

[0132] The first stage is to complete the flow collection;

[0133] The second stage is to extract features, compress the original bidirectional flow into feature tuple form;

[0134] The third stage is to use the XGBoost machine learning model to intelligently detect encrypted mining traffic;

[0135] The fourth stage is to send the detection results to the web client through the network and display them.

[0136] ​The specific process includes: the system captures bidirectional traffic data through a network interface, covering inbound and outbound packets, ensuring that complete network communication records are collected to provide raw data support for subsequent analysis; the model analyzes the original input traffic and extracts IP layer and transport layer data, quickly filters non-TLS traffic, significantly reduces subsequent computing overhead, and thus improves the inference speed and throughput of the system; a five-tuple (source IP, destination IP, source port, destination port, protocol number) is used to uniquely identify bidirectional TLS sessions, and the first packet direction is marked as 1, and the reverse direction traffic is automatically merged and marked as -1, while the original timestamp is retained to ensure the accuracy of the timing analysis. Through a hash table, the traffic matching has an O(n) time complexity, and only three key fields, including packet length, timestamp and direction identifier, are stored. This algorithm significantly reduces the space complexity and supports real-time detection and large-scale data analysis; the constructed bidirectional TLS flow hash table is used as input, and the data traffic packets are arranged in timestamp order, so that each data packet is associated with a set time point. By statistically calculating the timing distribution, length distribution and direction distribution of the data packets in the flow, features such as the total number of data packets, the total number of bytes and the average packet length are extracted; if the entire data flow is traversed from the beginning each time in a real-time detection scenario, it will result in high time complexity, which obviously cannot meet the real-time detection requirements. The patent proposes an efficient mining cycle feature extraction algorithm based on the idea of dynamic programming. By maintaining a hash table set to store and update key feature values, including the number of forward task packets, the number of reverse task packets, the number of forward submission packets, the number of reverse submission packets, and the number of cycles that meet the cycle. This design can process the length and direction information of the data packets received in real time and dynamically adjust the above five key values to realize state transition and feature extraction; an XGBoost (Extreme Gradient Boosting) machine learning algorithm is used to build a detection model. The model is trained with labeled traffic data and can identify the feature patterns of encrypted mining traffic. The system inputs the extracted feature tuples into the model, and the model outputs the traffic classification result to determine whether there is encrypted mining behavior.

[0137] Here, the detection results are sent to the Web client through the network and presented to the user in an intuitive way. The display content includes the proportion of detected mining traffic, risk level assessment, related IP addresses and timestamps, and other key information. The user interface provides interactive charts and data.

[0138] Specifically, the method further includes:

[0139] The accuracy Accuracy, precision Precision, recall Recall, and F1-Score are used to determine the performance of the pre-established TLS detection algorithm.

[0140] wherein the accuracy Accuracy represents a proportion of samples that the model predicts correctly in total samples; the precision Precision represents a proportion of samples that the model predicts as positive classes in actual positive classes; the recall Recall represents a proportion of samples that the model correctly predicts as positive classes in actual positive classes; and the F1-Score represents a proportion of samples that the model correctly predicts as positive classes in actual positive classes.

[0141] wherein the accuracy Accuracy is calculated by the following formula:

[0142]

[0143] wherein, TP (True Positive) represents true positive, i.e. a number of samples that are actually positive and correctly identified as positive by the model; FP (False Positive) represents false positive, i.e. a number of samples that are actually negative but incorrectly identified as positive by the model; TN (True Negative) represents true negative, i.e. a number of samples that are actually negative and correctly identified as negative by the model; and FN (False Negative) represents false negative, i.e. a number of samples that are actually positive but incorrectly identified as negative by the model.

[0144] wherein the precision Precision is calculated by the following formula:

[0145]

[0146] wherein, TP (True Positive) represents true positive, i.e. a number of samples that are actually positive and correctly identified as positive by the model; and FP (False Positive) represents false positive, i.e. a number of samples that are actually negative but incorrectly identified as positive by the model.

[0147] wherein the recall Recall is calculated by the following formula:

[0148]

[0149] wherein, TP (True Positive) represents true positive, i.e. a number of samples that are actually positive and correctly identified as positive by the model; and FN (False Negative) represents false negative, i.e. a number of samples that are actually positive but incorrectly identified as negative by the model.

[0150] wherein the F1-Score is calculated by the following formula:

[0151]

[0152] wherein Precision represents the precision rate.

[0153] As an example, the data sets used in the present application are divided into two categories: malicious traffic data sets and benign traffic data sets. Among them, the malicious traffic data set is composed of encrypted mining traffic, and the benign traffic data set is generated by normal online behavior. Due to the extremely limited publicly available encrypted mining traffic data, this paper uses the following two sources of encrypted mining traffic data: one is the encrypted active mining traffic collected by the experimental environment, and the other is the encrypted hijacking data subset from the DataCon2022 competition. The benign traffic data uses the benign data set of the DataCon2022 competition, which not only covers a wealth of benign network traffic, but also contains traffic generated by various mining behaviors, which can better simulate real network scenarios. In the data preprocessing stage, the original data is cleaned and optimized, including removing outliers and redundant data, and normalizing the features to improve the performance of machine learning algorithms. Finally, the data set contains 209616 normal TLS encrypted traffic messages and 28321 TLS encrypted mining messages, providing a high-quality data foundation for subsequent model construction and training.

[0154] In order to systematically evaluate the effectiveness of the features and the detection performance of XGBoost, this section inputs the feature vectors generated by the flow feature extraction algorithm into various classic machine learning classifiers for comparative experiments. On all evaluation indicators, XGBoost shows excellent classification performance, with three indicators reaching a peak level of 0.99. Comparative experiments show that traditional algorithms such as KNN, SVM and GNB are difficult to effectively identify mining samples. Further analysis shows that XGBoost, with its unique model architecture advantage, exhibits significant robustness in the presence of uneven data distribution and noise interference. Compared with other ensemble algorithms such as LR, GBM and RF, XGBoost can adaptively adjust model parameters through internal mechanisms, dynamically adapting to different data feature distributions.

[0155] The technical features of the above embodiments can be combined in any way. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present application.

[0156] The real-time TLS encrypted active mining traffic monitoring method provided by the embodiments of the present application can effectively improve the monitoring accuracy and response speed of the cryptocurrency mining behavior, adapt to multiple scene requirements, and provide reliable technical support for network security supervision.

[0157] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described above, however, any combination of these technical features is deemed to be within the scope of the present application.

[0158] The above embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the patent scope of the present application. It should be pointed out that, for ordinary skilled persons in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A method for real-time monitoring of TLS-encrypted active mining traffic, characterized in that, The method includes: Real-time acquisition of TLS stream data; Based on a pre-established TLS detection algorithm, active mining traffic is determined according to the TLS stream data; Specifically, based on a pre-established TLS detection algorithm, the active mining traffic is determined according to the TLS stream data, including: The pre-established TLS detection algorithm is used to extract bidirectional TLS streams and filter out non-TLS traffic. Based on a pre-established feature extraction algorithm, the length and direction information of continuously received data packets are processed, and key values ​​are dynamically adjusted to perform state transitions and feature extraction. Active mining traffic is identified by classifying crypto mining traffic using a pre-trained machine learning XGBoost model.

2. The method according to claim 1, characterized in that, Real-time acquisition of TLS stream data, including: Capture bidirectional traffic data through the network interface, covering both inbound and outbound packets, to ensure that a complete record of network communication is collected.

3. The method according to claim 1, characterized in that, The method further includes: Parse TLS stream data, extract IP layer and transport layer data, and filter non-TLS traffic; A five-tuple is used to uniquely identify a bidirectional TLS session, and the first packet in the direction of the first packet is marked as 1, while traffic in the opposite direction is automatically merged and marked as -1. Traffic matching with time complexity is achieved through a hash table, which stores three key fields: packet length, timestamp, and direction identifier.

4. The method according to claim 1, characterized in that, The steps of processing continuously received data packet length and direction information based on a pre-established feature extraction algorithm, and dynamically adjusting key values ​​to perform state transitions and feature extraction include: The constructed bidirectional TLS stream hash table is used as input. Data traffic packets are arranged in timestamp order, so that each data packet is associated with a set time point. The total number of data packets, total number of bytes, and average packet length are extracted by statistically calculating the temporal distribution, length distribution, and direction distribution of data packets in the stream. Based on a pre-established feature extraction algorithm, a hash table set is maintained to store and update key feature values, including the number of forward task packages, the number of reverse task packages, the number of forward submission packages, the number of reverse submission packages, and the number of cycles that satisfy the loop. The key feature values ​​are dynamically adjusted to perform state transitions and feature extraction. The key feature values ​​include the number of forward task packages, the number of reverse task packages, the number of forward submission packages, the number of reverse submission packages, and the number of cycles that satisfy the loop.

5. The method according to claim 1, characterized in that, The XGBoost machine learning model is trained using the following steps: Retrieve labeled traffic data; The labeled traffic data is used to train the XGBoost machine learning model to identify characteristic patterns in crypto mining traffic. The method includes: Based on the extracted feature tuples input into the model and the classification results of the pre-trained machine learning XGBoost model, it is determined whether crypto mining behavior exists.

6. The method according to claim 5, characterized in that, The XGBoost machine learning model uses a loss function as its optimization objective, and the formula for the loss function is as follows: Among them, y i For real labels, p i Here, N represents the probability predicted by the model, and N is the number of samples.

7. The method according to claim 1, characterized in that, The method further includes: The performance of the pre-established TLS detection algorithm is determined using accuracy, precision, recall, and F1-score. Wherein, accuracy represents the proportion of samples correctly predicted by the model out of the total samples; precision represents the proportion of samples predicted as positive by the model that are actually positive; recall represents the proportion of samples that are actually positive that the model correctly predicted as positive; and F1-Score represents the proportion of samples that are actually positive that the model correctly predicted as positive. The accuracy is calculated using the following formula: In this context, TP (True Positive) represents the number of samples that are actually positive and correctly identified as positive by the model; FP (False Positive) represents the number of samples that are actually negative but incorrectly identified as positive by the model; TN (True Negative) represents the number of samples that are actually negative and correctly identified as negative by the model; and FN (False Negative) represents the number of samples that are actually positive but incorrectly identified as negative by the model.

8. The method according to claim 7, characterized in that, Precision is calculated using the following formula: In this context, TP (True Positive) represents the number of samples that are actually positive and are correctly identified as positive by the model; FP (False Positive) represents the number of samples that are actually negative but are incorrectly identified as positive by the model.

9. The method according to claim 8, characterized in that, The recall rate is calculated using the following formula: In this context, TP (True Positive) represents the number of samples that are actually positive and are correctly identified as positive by the model; FN (False Negative) represents the number of samples that are actually positive but are incorrectly identified as negative by the model.

10. The method according to claim 9, characterized in that, Calculate the F1 score using the following formula: Precision refers to the accuracy rate.

Images