Identification technique of cryptomining behavior based on traffic features
Recently, the growth of blockchain technology and the economic benefits of cryptocurrencies have led to a proliferation of malicious cryptomining activities on the internet, resulting in significant losses for companies and institutions. Therefore, accurately detecting and identifying these behavior...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Frontiers Media S.A.
2023-09-01
|
| Series: | Frontiers in Physics |
| Subjects: | |
| Online Access: | https://www.frontiersin.org/articles/10.3389/fphy.2023.1269889/full |
| _version_ | 1797678849013579776 |
|---|---|
| author | Lijian Dong Zhigang Li Xiangrong Li Xiaofeng Wang Yuan Liu |
| author_facet | Lijian Dong Zhigang Li Xiangrong Li Xiaofeng Wang Yuan Liu |
| author_sort | Lijian Dong |
| collection | DOAJ |
| description | Recently, the growth of blockchain technology and the economic benefits of cryptocurrencies have led to a proliferation of malicious cryptomining activities on the internet, resulting in significant losses for companies and institutions. Therefore, accurately detecting and identifying these behaviors has become essential. To address low accuracy in detecting and identifying cryptomining behaviors in encrypted traffic, a technique for identifying cryptomining behavior traffic is proposed. This technique is based on the time series characteristics of network traffic and introduces the feature of long-range dependence, and the recognition effect is not easily affected by the encryption algorithm. First, 48-dimensional features are extracted from the network traffic using statistical methods and the rescaled range method, of which 47 dimensions are statistical features and 1 dimension is a long-range dependence feature. Second, because there is much less cryptomining traffic information than normal network traffic information in the dataset, the dataset is processed using oversampling to make the two types of traffic data balanced. Finally, a random forest model is used to identify the type of traffic based on its features. Experiments demonstrate that this approach achieves good detection performance and provides an effective solution for identifying encrypted network traffic with malicious cryptomining behavior. The long-range dependence features introduced therein together with the statistical features describe a more comprehensive flow characteristics, and the preprocessing of the dataset improves the performance of the identification model. |
| first_indexed | 2024-03-11T23:05:55Z |
| format | Article |
| id | doaj.art-d63f349d0ba747b8bd8e9b7cd67cc2f3 |
| institution | Directory Open Access Journal |
| issn | 2296-424X |
| language | English |
| last_indexed | 2024-03-11T23:05:55Z |
| publishDate | 2023-09-01 |
| publisher | Frontiers Media S.A. |
| record_format | Article |
| series | Frontiers in Physics |
| spelling | doaj.art-d63f349d0ba747b8bd8e9b7cd67cc2f32023-09-21T13:11:38ZengFrontiers Media S.A.Frontiers in Physics2296-424X2023-09-011110.3389/fphy.2023.12698891269889Identification technique of cryptomining behavior based on traffic featuresLijian Dong0Zhigang Li1Xiangrong Li2Xiaofeng Wang3Yuan Liu4School of Artificial Intelligence and Computer Science, Jiangnan University, Wuxi, ChinaAutolink Information Technology Co., Ltd., Wuxi, ChinaAutolink Information Technology Co., Ltd., Wuxi, ChinaSchool of Artificial Intelligence and Computer Science, Jiangnan University, Wuxi, ChinaSchool of Artificial Intelligence and Computer Science, Jiangnan University, Wuxi, ChinaRecently, the growth of blockchain technology and the economic benefits of cryptocurrencies have led to a proliferation of malicious cryptomining activities on the internet, resulting in significant losses for companies and institutions. Therefore, accurately detecting and identifying these behaviors has become essential. To address low accuracy in detecting and identifying cryptomining behaviors in encrypted traffic, a technique for identifying cryptomining behavior traffic is proposed. This technique is based on the time series characteristics of network traffic and introduces the feature of long-range dependence, and the recognition effect is not easily affected by the encryption algorithm. First, 48-dimensional features are extracted from the network traffic using statistical methods and the rescaled range method, of which 47 dimensions are statistical features and 1 dimension is a long-range dependence feature. Second, because there is much less cryptomining traffic information than normal network traffic information in the dataset, the dataset is processed using oversampling to make the two types of traffic data balanced. Finally, a random forest model is used to identify the type of traffic based on its features. Experiments demonstrate that this approach achieves good detection performance and provides an effective solution for identifying encrypted network traffic with malicious cryptomining behavior. The long-range dependence features introduced therein together with the statistical features describe a more comprehensive flow characteristics, and the preprocessing of the dataset improves the performance of the identification model.https://www.frontiersin.org/articles/10.3389/fphy.2023.1269889/fulllong-range dependencecryptominingfeature extractiontraffic identificationblockchain |
| spellingShingle | Lijian Dong Zhigang Li Xiangrong Li Xiaofeng Wang Yuan Liu Identification technique of cryptomining behavior based on traffic features Frontiers in Physics long-range dependence cryptomining feature extraction traffic identification blockchain |
| title | Identification technique of cryptomining behavior based on traffic features |
| title_full | Identification technique of cryptomining behavior based on traffic features |
| title_fullStr | Identification technique of cryptomining behavior based on traffic features |
| title_full_unstemmed | Identification technique of cryptomining behavior based on traffic features |
| title_short | Identification technique of cryptomining behavior based on traffic features |
| title_sort | identification technique of cryptomining behavior based on traffic features |
| topic | long-range dependence cryptomining feature extraction traffic identification blockchain |
| url | https://www.frontiersin.org/articles/10.3389/fphy.2023.1269889/full |
| work_keys_str_mv | AT lijiandong identificationtechniqueofcryptominingbehaviorbasedontrafficfeatures AT zhigangli identificationtechniqueofcryptominingbehaviorbasedontrafficfeatures AT xiangrongli identificationtechniqueofcryptominingbehaviorbasedontrafficfeatures AT xiaofengwang identificationtechniqueofcryptominingbehaviorbasedontrafficfeatures AT yuanliu identificationtechniqueofcryptominingbehaviorbasedontrafficfeatures |