Wallet Address Extraction for Malicious Mining Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for identifying malicious mining behavior are inaccurate due to indeterminacy in mining program features across different protocols or versions, and attackers often use proxy addresses to evade detection, reducing the effectiveness of mining behavior detection.
Innovation Solution
A method and apparatus that extract wallet addresses from operation data using preset rules and regular expressions, and monitor network outgoing connections to identify malicious mining behavior by detecting wallet addresses associated with mining activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If mining behavior is detected by identifying string features from traffic packets, then detection capability is provided, but detection accuracy deteriorates due to feature indeterminacy across different protocols or versions and proxy address usage
Solution Approach 1:
The patent extracts wallet addresses from operation data (process execution commands, file modifications, registry changes) and uses them as the primary detection feature. This extraction approach removes the dependency on traffic packet string features that vary across protocols and versions, thereby improving detection accuracy while maintaining adaptability across different mining software versions and protocols.
Solution Approach 2:
The patent shifts the detection dimension from network traffic analysis (L3/L4 layer) to system operation analysis (process, file, registry layers). By monitoring wallet addresses in system operations rather than traffic packets, the solution operates in a different dimensional space where protocol and version variations do not affect detection accuracy.
2Object-affected harmful factors
If attackers use proxy addresses to connect to mining pools, then evasion capability is improved, but detection effectiveness deteriorates due to inability to accurately locate the mining pool
Solution Approach 1:
The patent introduces wallet addresses as an intermediary identifier that bridges the gap between the attacker's proxy connection and the actual mining pool. By tracking the wallet address extracted from system operations, the detection system can identify malicious mining behavior regardless of which proxy address is used to connect to the mining pool, effectively neutralizing the evasion technique.
3Device complexity
If conventional traffic packet analysis is used for mining detection, then detection process is simple, but detection reliability deteriorates due to feature indeterminacy and format modifications by attackers
Solution Approach 1:
The patent performs preliminary extraction and collection of wallet addresses from system operations before analyzing network connections. By pre-collecting wallet addresses from process executions, file modifications, and registry changes, the system builds a reference set of suspicious addresses that can be reliably matched against network traffic, improving detection reliability without significantly increasing overall system complexity.
Data Source
AI summary
Provided are a method and apparatus for identifying a malicious mining behavior, an electronic device, and a storage medium. The method includes: obtaining operation data corresponding to a target operation, on capturing of the target operation; extracting a wallet address from the operation data to obtain a wallet address set obtaining data of a network outgoing connection for external access, and determining whether the data of the network outgoing connection comprises a wallet address belonging to the wallet address set and determining that the data of the network outgoing connection corresponds to the malicious mining behavior, on determining that the data of the network outgoing connection comprises a wallet address belonging to the wallet address set.