Abstract:Cryptocurrency is becoming more and more popular due to its superiority to traditional currencies, resulting in the boom of mining. Mining cryptocurrencies requires tremendous computing resources, and extensive high-performance computers are used for mining nowadays. A significant consequent problem is the huge amount of energy consuming for mining. Thus, managing mining behaviors become an urgent issue. There are two main ways to detecting mining behavior. One is to deploy a detecting program on the target host, and use features of system calls to detect the mining behaviors. The other is to deploy detection models on network, and identify mining behaviors via network traffic. Comparing with the former method, detecting mining behavior by traffic is “non-contact”, and can monitor a whole network instead of a single host. We propose in this paper a convolutional function based method to extract the features from the first few packets of flows to identify mining traffic. We first extract the size of each packet of a flow, and then design a convolution function with a sliding window to extract meaningful features from the packet size sequence. This method maps the flows to a feature space in which the mining flows can be distinguished from the normal flows easily. We collect a set of mining traffic traces including 8 types of cryptocurrency mining behaviors in a real network, and launch a set of empirical studies using this data set. We also develop an online mining traffic identification platform to validate the performance of our proposal. Both the offline experimental results and the online validation results suggests that our proposal can achieve high performance satisfying the real mining traffic detecting requirements.

IP traffic behavior characterization via semantic mining

Cause of symmetry for traffic volume: Mining and exploring new characteristics of traffic in non-business networks

Survey and analysis on the Internet traffic model

DeepHTTP: Semantics-Structure Model with Attention for Anomalous HTTP Traffic Detection and Pattern Mining

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

Users' Behavior Character Analysis and Classification Approaches in Enterprise Networks

Measuring and classifying IP usage scenarios: a continuous neural trees approach

Behavior Spectrum: an Effective Method for User's Web Access Behavior Monitoring and Measurement

Dynamic Group Behavior Analysis and Its Application in Network Abnormal Behavior Detection.

Characterizing Application Behaviors for Classifying P2p Traffic

Mining Long-Term Stealthy User Behaviors on High Speed Links

MUCM: Multilevel User Cluster Mining Based on Behavior Profiles for Network Monitoring.

Scalable Web Traffic Simulations Based on User Personalization

Dynamic Feature Analysis and Measurement for Large-Scale Network Traffic Monitoring

Mining and modelling the dynamic patterns of service providers in cellular data network based on big data analysis

An Automatic Scheme to Categorize User Sessions in Modern HTTP Traffic

Detecting a Variety of Long-Term Stealthy User Behaviors on High Speed Links

Internet Traffic Analysis in a Large University Town: A Graphical and Clustering Approach.

Towards a Profiling View for Unsupervised Traffic Classification by Exploring the Statistic Features and Link Patterns

An early stage convolutional feature extracting method using for mining traffic detection

A Network Misuse Detection Mechanism Based on Traffic Log