Cryptojacking Detection via Signal Processing of System Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions are inadequate in detecting unknown or ongoing cryptojacking operations, particularly those that are not identified by browser-based detection methods, as they rely on signature-based technologies that struggle with new or customized malware, and network-based solutions may fail when new cryptojacking operations use authorized ports or unknown mining pool servers.
Innovation Solution
A cryptojacking detection engine that correlates data from per-process performance counters, network event traces, and dynamic disassembly of running code to identify cryptomining patterns, treating the data as a discrete audio signal to build confidence in detection, and classifying intervals as suspicious or not suspicious, ultimately determining if a system is under cryptojacking stress.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection technologies are used, then known cryptojacking operations can be identified, but unknown or customized malware cannot be detected
Solution Approach 1:
The patent replaces signature-based mechanical detection with signal processing techniques. The system captures system data (CPU usage, memory access patterns, network communication) and processes it as a signal to detect cryptojacking operations. This substitution allows detection of unknown malware patterns rather than relying on pre-defined signatures, thereby improving adaptability to new threats while maintaining detection reliability through statistical analysis and machine learning algorithms.
2Reliability
If network-based detection solutions are used, then cryptojacking operations using known indicators can be detected, but operations using authorized ports or unknown mining pool servers escape detection
Solution Approach 1:
The patent implements a multi-functional detection system that monitors multiple data sources simultaneously (CPU performance counters, memory access patterns, network event traces, process creation events). This universal monitoring approach allows the system to detect cryptojacking operations regardless of which specific indicator they use, including authorized ports or unknown mining pool servers, thereby improving detection coverage without sacrificing reliability in any single detection area.
Solution Approach 2:
The system merges multiple detection signals from different data sources into a unified detection framework. By combining CPU usage patterns, memory access characteristics, network communication behaviors, and process creation events into a single signal processing pipeline, the system achieves comprehensive detection capability that maintains high reliability across diverse attack vectors while improving adaptability to new cryptojacking techniques.
3Measurement precision
If comprehensive data collection from multiple sources is performed, then detection accuracy improves, but system performance and resource consumption increase
Solution Approach 1:
The patent segments the data collection and processing into distinct temporal intervals. Instead of continuously processing all data at once, the system divides monitoring into discrete time windows and processes data from multiple sources independently within each interval. This segmentation allows the system to maintain high measurement precision by analyzing comprehensive data while improving productivity through parallel processing and reduced computational burden during each interval.
Solution Approach 2:
The system applies partial signal processing to each temporal interval rather than processing all collected data simultaneously. By processing data in manageable chunks across multiple intervals, the system achieves sufficient detection confidence without the full computational cost of analyzing all data at once, thus balancing measurement precision with system performance and resource consumption.
Data Source
AI summary
There is disclosed in one example a computing apparatus, including: a processor; and logic encoded into one or more computer-readable mediums, the logic to instruct the processor to: capture first data from an intermediate data source across a first temporal interval; perform partial signal processing on the first data to classify the first temporal interval as either suspicious or not suspicious, wherein the first temporal interval is classified as suspicious if it is determined to potentially represent at least a portion of a cryptomining operation; classify second through N temporal intervals as either suspicious or not suspicious; based on the first through N temporal intervals, classify the apparatus as either operating a cryptomining function or not; and upon classifying the apparatus as operating a cryptomining function and determining that the cryptomining function is not authorized, take remedial action on the apparatus.