Publication Details

How to detect cryptocurrency miners? By traffic forensics!

VESELÝ Vladimír and ŽÁDNÍK Martin. How to detect cryptocurrency miners? By traffic forensics!. Digital Investigation, vol. 31, no. 31, 2019, pp. 1-14. ISSN 1742-2876. Available from: https://doi.org/10.1016/j.diin.2019.08.002
Czech title
Jak odhalit těžaře kryptoměn? Pomocí analýzy provozu!
Type
journal article
Language
english
Authors
Veselý Vladimír, Ing., Ph.D. (DIFS FIT BUT)
Žádník Martin, Ing., Ph.D. (DCSY FIT BUT)
URL
Keywords

Bitcoin, Cryptocurrency, Mining pool, Mining server, Stratum protocol, GetBlockTemplate protocol, GetWork protocol

Abstract

Cryptocurrencies set a new trend for a financial interaction between people. In order to successfully meet this use-case, cryptocurrencies combine various advanced information technologies (e.g., blockchain as a replicated database, asymmetrical ciphers and hashes guaranteeing integrity properties, peer-to-peer networking providing fault-tolerant service). Mining process not only introduces new cryptocurrency units, but it has become a business how to generate revenue in real life. This paper aims at different approaches how to detect cryptocurrency mining within corporate networks (where it should not be present). Mining activity is often a sign of malware presence or unauthorized exploitation of company resources. The article provides an in-depth overview of pooled mining process including deployment and operational details. Two detection methods and their implementations are available for network administrators, law enforcement agents and the general public interested in cryptocurrency mining forensics.

Published
2019
Pages
1-14
Journal
Digital Investigation, vol. 31, no. 31, ISSN 1742-2876
Book
Digital Investigation
Publisher
Elsevier Science
DOI
10.1016/j.diin.2019.08.002
UT WoS
000504333700004
EID Scopus
2-s2.0-85071993301
BibTeX 
@ARTICLE{FITPUB12057,
   author = "Vladim\'{i}r Vesel\'{y} and Martin \v{Z}\'{a}dn\'{i}k",
   title = "How to detect cryptocurrency miners? By traffic forensics!",
   pages = "1--14",
   booktitle = "Digital Investigation",
   journal = "Digital Investigation",
   volume = 31,
   number = 31,
   year = 2019,
   ISSN = "1742-2876",
   doi = "10.1016/j.diin.2019.08.002",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/12057"
}
Back to top