Processor Telemetry Analysis for Cryptocurrency Mining Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data centers face challenges in detecting unauthorized cryptocurrency mining activities on processors, which can lead to resource misuse, downtime, and increased operating costs, as malicious entities can hijack processors to execute prohibited processes without being detected.
Innovation Solution
A system and method that analyze execution telemetry data from processors to determine the likelihood of cryptocurrency mining by deriving features from measurements such as processor temperature and memory usage, and using a machine learning model like a random forest to classify processes, enabling the detection of prohibited activities like cryptocurrency mining amidst allowed processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional processor monitoring methods are used, then system simplicity is maintained, but detection accuracy of cryptocurrency mining activities is insufficient
Solution Approach 1:
The system segments the detection process into multiple independent components: telemetry data collection from processors, feature extraction from raw data, machine learning model analysis, and classification output. This segmentation enables high detection accuracy through specialized processing at each stage while maintaining manageable system complexity through modular architecture.
Solution Approach 2:
The patent introduces feature extraction as an intermediary layer between raw telemetry data and machine learning analysis. This intermediary transforms complex processor metadata into meaningful features that enhance detection accuracy without requiring the machine learning model to directly process raw data, thus managing system complexity.
2Reliability
If comprehensive telemetry data collection is implemented, then detection capability is improved, but data processing overhead increases
Solution Approach 1:
The system extracts only the most relevant features from comprehensive telemetry data using feature extraction techniques. Instead of processing all raw telemetry data through machine learning models, the system identifies and extracts key features that are most indicative of cryptocurrency mining activities, thereby improving detection capability while reducing processing overhead and time.
3Measurement precision
If machine learning models are deployed for process classification, then accuracy in identifying prohibited processes is improved, but computational resource consumption increases
Solution Approach 1:
The system applies machine learning models selectively rather than continuously to all processor activities. The monitoring system uses feature extraction to identify suspicious patterns first, then applies computationally intensive machine learning classification only when needed, achieving high classification accuracy for prohibited processes while minimizing overall computational resource consumption.
Data Source
AI summary
A system and method may determine if a class of process (e.g. NN execution, cryptocurrency mining, graphic processing) is executing on a processor, or which class is executing, by calculating or determining features from execution telemetry or measurements collected from processors executing processes, and determining from at least a subset of the features the likelihood that the processor is executing the class of process. Execution telemetry may include data regarding or describing the execution of the process, or describing hardware used to execute the process, such as processor temperature, memory usage, etc.