Detection of cryptominers and mining botnets

Samuel Obuch

Bachelor's thesis

Abstract:

Kryptomeny nedávno zaznamenali veľký nárast popularity, čo sa prejavilo aj v náraste počtu súvisiacich škodlivých aktivít. Cieľom tejto práce je preskúmať tieto aktivity a navrhnúť metódu ich detekcie založenú na ich sieťových charakteristikách, získaných zo sieťových tokov. Vyhodnotenie navrhnutej metódy proti referenčnej metóde založenej na blockliste ukázalo, že metóda má vysokú presnosť. Porovnanie s odlišnou metódou implementovanou Flovmonom ukázalo, že naša metóda produkuje oveľa menší počet falošne pozitívnych výsledkov. Z tohto dôvodu je vhodnejšia na použitie na automatické testovanie.

Abstract:

Cryptocurrencies got very popular recently, and this popularity also resulted in an increase in related malicious activities. The goal of this thesis is to study these activities and to implement a method for their detection based on their network characteristics obtained from network flows. Evaluation of the method proposed in this thesis against a reference method based on a blocklist showed, that the proposed method has high accuracy and precision. A comparison made against another method implemented by Flowmon showed that our method generates a far lower rate of false positives. Therefore it is more suitable for use in a highly automated environment.

Keywords

cryptocurrency, cryptomining, detection, miningpools, Stratum, IPFIX, network flows

Language used: English

Date on which the thesis was submitted / produced: 24. 5. 2019

Thesis defence

• Date of defence: 24. 6. 2019
• Supervisor: RNDr. Martin Laštovička
• Reader: RNDr. Martin Husák

Masaryk University

Faculty of Informatics

Bachelor programme / field:
Informatics / Computer Systems and Data Processing