Network Traffic Monitoring for Cryptojacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network monitoring systems are ineffective in detecting and mitigating cryptojacking attacks, especially when attackers use customized proxies not included in known cryptocurrency pools, as they evade detection and can orchestrate attacks from remote locations.
Innovation Solution
A method is implemented to monitor network traffic by determining if requests and responses match cryptocurrency protocols, with intervention actions such as adding destinations to a blacklist or dropping requests, to identify and prevent cryptojacking activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If known cryptocurrency pools are applied to DNS response policy zone firewall rules, then detection of cryptojacking attacks is improved, but detection effectiveness deteriorates when attackers use customized proxies not included in known pools
Solution Approach 1:
The patent changes the detection parameter from relying on known cryptocurrency pool addresses to analyzing protocol-specific characteristics of requests and responses. By examining whether requests and responses use protocols specified for cryptocurrency communication, the system adapts to detect any cryptocurrency mining activity regardless of the specific proxy or pool being used, thus resolving the contradiction between reliable detection and adaptability to customized proxies
Solution Approach 2:
The patent introduces an intermediary verification mechanism that sends test requests through the suspected cryptojacking connection and analyzes the responses. This intermediary approach allows the system to detect cryptocurrency mining activity by observing protocol-specific behavior in the communication flow, rather than relying on pre-known pool addresses, thereby enabling detection of customized proxies while maintaining detection reliability
2Measurement precision
If protocol-specific cryptocurrency request and response analysis is implemented, then detection accuracy for customized proxies is improved, but system complexity increases
Solution Approach 1:
The patent segments the detection process into distinct components: receiving requests from protected hosts, determining whether requests use cryptocurrency protocols, submitting test requests, analyzing responses for protocol compliance, and implementing intervention actions. This segmentation allows the complex detection task to be broken down into manageable, modular steps that can be implemented systematically, reducing overall system complexity while maintaining high detection accuracy
Solution Approach 2:
The patent implements feedback mechanisms where the system analyzes responses to test requests and uses this information to determine whether a destination is engaged in cryptocurrency mining. The feedback loop continues with intervention actions such as blacklisting destinations or dropping requests, creating a closed-loop system that automatically adjusts based on detected threats, thereby managing complexity through automated decision-making rather than requiring complex manual configuration
Data Source
AI summary
A method of monitoring network traffic for cryptojacking activity is provided. A request is received from a protected host. It is determined whether the request is a cryptocurrency request based on whether the request uses a protocol specified for requests belonging to the cryptocurrency communication. In response to a determination that the request is a cryptocurrency request for the cryptocurrency, a second request is submitted to a destination indicated by the request, wherein the second request is formatted as a cryptocurrency request for the cryptocurrency. A determination is made whether a reply to the second request from the destination is a cryptocurrency response for the cryptocurrency based on whether the response uses a protocol specified for a response that belongs to communication associated with the cryptocurrency. An intervention action is caused in response to a determination that the reply to the second request from the destination is a cryptocurrency response for the cryptocurrency.