Cryptomining Detection via Resource Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unauthorized cryptomining activities consume processor, memory, and electricity resources without the knowledge or consent of device owners, posing a financial and operational burden due to the lack of effective detection methods.
Innovation Solution
A processing system embedded in a device operating system monitors processor usage, memory usage, network activity, and temperature to detect patterns indicative of cryptomining, generating an alert when thresholds are exceeded, utilizing machine learning to differentiate between normal and unauthorized activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If monitoring systems track all processor, memory, and network usage patterns, then detection accuracy improves, but system complexity and resource consumption increase
Solution Approach 1:
The monitoring system segments resource usage into distinct categories (processor utilization, memory utilization, network utilization) and analyzes each separately for specific cryptomining patterns. This segmentation allows detailed detection without requiring a monolithic complex system, as each component can be monitored independently using targeted detection rules.
Solution Approach 2:
The system establishes baseline usage patterns and thresholds in advance before actual cryptomining detection is needed. By pre-defining what normal usage looks like and setting alert thresholds, the system prepares detection mechanisms ahead of time, reducing the need for complex real-time analysis during actual monitoring operations.
2Reliability
If continuous monitoring of resource utilization patterns is implemented, then unauthorized cryptomining detection capability improves, but energy consumption increases
Solution Approach 1:
Instead of continuous real-time monitoring, the system employs periodic sampling of resource utilization data at defined intervals. This periodic action maintains detection capability while significantly reducing energy consumption compared to continuous monitoring, as the system only activates sensors and processors at scheduled intervals rather than continuously.
Solution Approach 2:
The monitoring system leverages existing device resources and operating system APIs to gather utilization data, rather than requiring dedicated hardware or separate monitoring services. This self-service approach allows the system to use already-consuming resources (processor cycles, memory) that would be there anyway during normal operation, minimizing additional energy overhead.
3Measurement precision
If the system analyzes detailed utilization patterns to detect cryptomining, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system applies partial analysis by focusing only on specific utilization patterns and thresholds that are most indicative of cryptomining activity, rather than analyzing every detail of resource usage. This partial action approach maintains sufficient detection accuracy for identifying cryptomining while reducing processing time compared to comprehensive analysis of all possible usage scenarios.
Solution Approach 2:
The system replaces complex real-time computational analysis with pattern-matching algorithms that compare observed utilization data against pre-established cryptomining signatures and thresholds. This substitution of mechanical computation with pattern recognition and threshold comparison significantly reduces processing time while maintaining detection accuracy, as pattern matching is computationally lighter than full behavioral analysis.
Data Source
AI summary
A processing system of a device having at least one processor may determine that a temperature of the device exceeds a threshold temperature and obtain, in response to the determining, utilization information of the device comprising: processor utilization information, memory utilization information, and network utilization information. The processing system may then detect, from the utilization information of the device, a pattern comprising: a first network utilization burst, a processor utilization exceeding a processor utilization threshold and a memory utilization exceeding a memory utilization threshold over at least a designated period of time following the first network utilization burst, and a second network utilization burst after at least the designated period of time. When the pattern is detected, the processing system may generate an unauthorized cryptomining alert.