CN116071057A - Encrypted coin mining behavior recognition method, encrypted coin detection device and storage medium - Google Patents
Encrypted coin mining behavior recognition method, encrypted coin detection device and storage medium Download PDFInfo
- Publication number
- CN116071057A CN116071057A CN202111290067.XA CN202111290067A CN116071057A CN 116071057 A CN116071057 A CN 116071057A CN 202111290067 A CN202111290067 A CN 202111290067A CN 116071057 A CN116071057 A CN 116071057A
- Authority
- CN
- China
- Prior art keywords
- network address
- private network
- coin
- information
- encrypted
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/04—Payment circuits
- G06Q20/06—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
- G06Q20/065—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme using e-cash
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/04—Payment circuits
- G06Q20/06—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3823—Payment protocols; Details thereof insuring higher security of transaction combining multiple encryption tools for a transaction
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Accounting & Taxation (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- Strategic Management (AREA)
- Finance (AREA)
- Computer Security & Cryptography (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention discloses a method for identifying mining behaviors of encrypted coins, an encrypted coin detection device and a storage medium. The encrypted coin mining behavior identification method comprises the following steps: acquiring a first private network address suspected to have a coin mining behavior through a preset mode; sending a coin detection message to a first private network address; and obtaining the encrypted coin response information sent from the first private network address to determine a second private network address from the first private network address, wherein the second private network address is the private network address with the encrypted coin mining behavior. In the technical scheme of the embodiment, the encrypted coin detection device can obtain the first private network address with the suspected encrypted coin behavior through the core network, and then send the encrypted coin detection message aiming at the first private network address to confirm the second private network address with the encrypted coin behavior, so that the problem that a specific user cannot be accurately positioned through public network address information can be solved, and the accuracy of identifying the encrypted coin mining behavior can be effectively improved.
Description
Technical Field
The invention relates to the technical field of communication, in particular to a method for identifying mining behaviors of encrypted coins, an encrypted coin detection device and a storage medium.
Background
With the development of society, the demand for electric power is also increasing, and the problem of electric power shortage often afflicts various countries. But with the rise of the cryptocurrency in recent years, such a service that severely consumes power resources aggravates a power resource gap, and in addition, the service also poses a serious challenge to the security of the power grid. Carbon neutralization programs have recently been proposed: "will improve the national autonomous contribution, take more powerful policy and measure, the carbon dioxide emissions strive to reach the peak before 2030, strive to realize the carbon neutralization before 2060. Therefore, the work of striking illegal mining behaviors, protecting the safety of a power grid and achieving the national planning target is very important. The related method proposes to deploy a large number of bitcoin probes in the public network, and presumes the identity information of the designated node by acquiring bitcoin transaction information broadcast information, but because the network address is limited, a public network address is usually divided into a plurality of users, and in addition, the public network address allocated to the users by the existing communication system is constantly changed, so that the specific users cannot be precisely positioned according to the public network address information by the method.
Disclosure of Invention
The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.
The embodiment of the invention provides a method for identifying the mining behavior of a encrypted coin, a device for detecting the encrypted coin and a storage medium, which can effectively improve the accuracy of identifying the mining behavior of the encrypted coin.
In a first aspect, an embodiment of the present invention provides a method for identifying a mining behavior of a cryptographic coin, which is applied to a cryptographic coin detection device, where the cryptographic coin detection device is disposed in a core network, and the method includes:
acquiring a first private network address through a preset mode, wherein the first private network address is a private network address corresponding to a user node suspected to have a coin mining behavior;
sending a coin detection message to the first private network address;
obtaining the response information of the encrypted coin sent by the first private network address;
and determining a second private network address from the first private network address according to the encrypted coin response information, wherein the second private network address is the private network address with encrypted coin mining behavior.
In a second aspect, an embodiment of the present invention further provides a cryptographic coin detecting apparatus, including: the system comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor realizes the encrypted coin mining behavior identification method according to the first aspect when executing the computer program.
In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium storing computer-executable instructions for performing the encrypted coin mining behavior identification method according to the first aspect above.
The encrypted coin mining behavior recognition method is applied to an encrypted coin detection device, the encrypted coin detection device is arranged on a core network, the encrypted coin detection device obtains a first private network address through a preset mode, and the first private network address is a private network address corresponding to a user node suspected of the encrypted coin mining behavior; sending a coin detection message to a first private network address; obtaining the response information of the encrypted coin sent by the first private network address; and determining a second private network address from the first private network address according to the encrypted coin response information, wherein the second private network address is the private network address with the encrypted coin mining behavior. In the technical scheme of the embodiment, the encrypted coin detection device can obtain the first private network address with the suspected encrypted coin behavior through the core network, and then send the encrypted coin detection message aiming at the first private network address to confirm the second private network address with the encrypted coin behavior, so that the problem that a specific user cannot be accurately positioned through public network address information can be solved, and the accuracy of identifying the encrypted coin mining behavior can be effectively improved.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
The accompanying drawings are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate and do not limit the invention.
FIG. 1 is a schematic diagram of a system architecture for performing a method for recognizing a cryptographic coin mining behavior provided in one embodiment of the present invention;
FIG. 2 is a flow chart of a method for identifying a mining behavior of a cryptocoin according to an embodiment of the present invention;
FIG. 3 is a flowchart of determining a first private network address by a first preset module in a method for identifying a cryptographic coin mining behavior according to an embodiment of the invention;
FIG. 4 is a flowchart of a method for identifying a cryptographic coin mining behavior according to one embodiment of the present invention, further defining a first private network address;
FIG. 5 is a flowchart of determining a target mining behavior user in a method for identifying a mining behavior of a cryptocoin according to an embodiment of the present invention;
FIG. 6 is a flowchart of determining a first private network address by a second preset module in a method for identifying a cryptographic coin mining behavior according to an embodiment of the invention;
fig. 7 is a flowchart of generating a mining behavior user list in the method for identifying a mining behavior of a cryptocoin according to an embodiment of the present invention.
Detailed Description
The present invention will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.
It should be noted that although a logical order is illustrated in the flowchart, in some cases, the steps illustrated or described may be performed in an order different from that in the flowchart. The terms first, second and the like in the description and in the claims and in the above-described figures, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order.
The invention provides a method for identifying a mining behavior of a cryptocoin, a cryptocoin detection device and a storage medium, wherein the method for identifying the mining behavior of the cryptocoin comprises the following steps: acquiring a first private network address through a preset mode, wherein the first private network address is the private network address corresponding to a user node suspected to have the encrypted coin mining behavior; sending a coin detection message to a first private network address; obtaining the response information of the encrypted coin sent by the first private network address; and determining a second private network address from the first private network address according to the encrypted coin response information, wherein the second private network address is the private network address with the encrypted coin mining behavior. In the technical scheme of the embodiment, the encrypted coin detection device can obtain the first private network address with the suspected encrypted coin behavior through the core network, and then send the encrypted coin detection message aiming at the first private network address to confirm the second private network address with the encrypted coin behavior, so that the problem that a specific user cannot be accurately positioned through public network address information can be solved, and the accuracy of identifying the encrypted coin mining behavior can be effectively improved.
Embodiments of the present invention will be further described below with reference to the accompanying drawings.
Referring to fig. 1, fig. 1 is a schematic diagram of a system architecture platform for performing a method for identifying a cryptographic coin mining behavior according to an embodiment of the present invention.
In the example of fig. 1, the system architecture platform is disposed in a core network, where the core network includes a cryptocoin detecting device 110, a network detail recording module 120 connected to the cryptocoin detecting device, and a user database module 130 connected to the cryptocoin detecting device, where the network detail recording module is used for providing a query interface of a user, and is used for querying a public network address and a private network address of the user corresponding to the public network address, and the user database module is used for querying a private network address capability of the user, and is also used for obtaining a private network address and port information of a specified user.
It should be noted that, the cryptocoin detecting device is a node containing each popular cryptocoin, and the modification is that for the P2P network of the active connection designated address port, for example, the bit coin is constructed based on TCP, and the default communication port of the main network is 8333; for another example, ethernet provides two connection modes, UDP and TCP, and the main network defaults to TCP port 30303, recommending UDP discovery port 30301. If the handshake with the designated node is successful, the opposite end host is proved to run the coin-in-process; if the passive monitoring mode is adopted, the system is equivalent to a node integrating the function of the main stream encryption coin node, is accessed to a network and receives the account book broadcast message.
It should be noted that the cryptocoin detecting device may include a cryptocoin sniffer, and other devices for discovering the user with mining behavior may be provided, which is not limited only in this embodiment.
It will be appreciated by those skilled in the art that the system architecture platform may be applied to 2G, 3G, 4G, 5G communication network systems, subsequent evolution mobile communication network systems, and the like, and the system architecture platform may also be applied to a fixed network communication network system, which is not particularly limited in this embodiment.
It should be noted that, when the system architecture platform is applied to the 5G mobile communication network system, the network detailed record module is a network detailed record (Internet Protocol Detail Record, IPDR), the user database module is a session management function (Session Management Function, SMF), and the encrypted coin detecting device can obtain the private network address of the specified user through the capability provided by the SMF for inquiring the private network address of the user; arranging a cryptographic coin sniffing device in the cryptographic coin detection device for discovering users with mining behaviors; meanwhile, the encrypted coin detection device can query the user corresponding to the public network address and the private network address by accessing the public network address query interface of the user provided by the IPDR.
When the system architecture platform is applied to a fixed network communication network system, the network detail record module is network detail record (Internet Protocol Detail Record, IPDR), the user database module is an authentication, authorization and accounting (Authentication, authorization, accounting, AAA) server, and the encrypted coin detection device can acquire the private network address and port of the appointed user through the private network address inquiring capability provided by the AAA; the encrypted coin detecting device is used for finding out the user with mining behavior; meanwhile, the encrypted coin detection device can access a query interface of the user provided by the IPDR, and query the public network address and the private network address of the user corresponding to the public network address.
Those skilled in the art will appreciate that the system architecture platform shown in fig. 1 is not limiting of the embodiments of the invention, and may include more or fewer components than shown, or may combine certain components, or a different arrangement of components.
Based on the system architecture platform, various embodiments of the encrypted coin mining behavior recognition method of the present invention are presented below.
As shown in fig. 2, fig. 2 is a flowchart of a method for recognizing a cryptographic coin mining behavior according to an embodiment of the present invention, which is applied to a cryptographic coin detecting apparatus. The encrypted coin mining behavior recognition method includes, but is not limited to, step S100, step S200, step S300 and step S400.
Step S100, a first private network address is obtained through a preset mode, wherein the first private network address is the private network address corresponding to a user node suspected to have the encrypted coin mining behavior.
Specifically, the encrypted coin detection device can find the user node suspected to have encrypted coin mining behavior through different preset modes, so that a first private network address corresponding to the user node can be obtained.
Note that, the suspected encrypted coin mining behavior may include abnormal electricity behavior, or may include behavior that information sent by the public network address includes encrypted coin broadcast information, and the implementation is not limited specifically to the suspected encrypted coin mining behavior.
It should be noted that, the preset mode may be a first preset mode, where the first preset mode is an active detection mode, and the first preset mode is used to obtain a private network address corresponding to a user node of the abnormal electricity consumption behavior; the preset mode may also be a second preset mode, where the second preset mode is a passive detection mode, and the second preset mode is used to obtain a private network address corresponding to a user node in a public network address including the encrypted coin broadcasting information in the sent information.
Step S200, sending the encrypted coin detection message to the first private network address.
Specifically, after determining a first private network address corresponding to a user node suspected of having a cryptographic coin mining behavior, the cryptographic coin detection device sends a cryptographic coin detection message to the first private network address.
Step S300, obtaining the encrypted coin response information sent from the first private network address.
Specifically, after the encrypted coin detection device sends the encrypted coin detection message to the first private network address, the encrypted coin detection device receives the encrypted coin response information sent from part of the first private network address.
Step S400, determining a second private network address from the first private network address according to the encrypted coin response information, wherein the second private network address is the private network address with the encrypted coin mining behavior.
Specifically, the encrypted coin detection device can determine a second private network address from the first private network address according to the encrypted coin response information, wherein the second private network address is the private network address with encrypted coin mining behaviors, and the encrypted coin detection device can obtain the first private network address with encrypted coin suspected behaviors through the core network and then send an encrypted coin detection message aiming at the first private network address to confirm the second private network address with encrypted coin behaviors, so that the problem that specific users cannot be accurately positioned through public network address information can be solved, and the accuracy of identifying the encrypted coin mining behaviors can be effectively improved.
In an embodiment, the encrypted coin detection device acquires a first private network address through a preset mode, wherein the first private network address is a private network address corresponding to a user node suspected of having encrypted coin mining behavior; sending a coin detection message to a first private network address; obtaining the response information of the encrypted coin sent by the first private network address; and determining a second private network address from the first private network address according to the encrypted coin response information, wherein the second private network address is the private network address with the encrypted coin mining behavior. In the technical scheme of the embodiment, the encrypted coin detection device can obtain the first private network address with the suspected encrypted coin behavior through the core network, and then send the encrypted coin detection message aiming at the first private network address to confirm the second private network address with the encrypted coin behavior, so that the problem that a specific user cannot be accurately positioned through public network address information can be solved, and the accuracy of identifying the encrypted coin mining behavior can be effectively improved.
In some embodiments, as shown in fig. 3, in the case where the preset mode is the first preset mode, step S100 includes, but is not limited to, the following steps S310, S320 and S330.
Step S310, obtaining address information of abnormal electricity utilization user information through a first preset mode;
step S320, obtaining the subscription user information corresponding to the address information from the user database module according to the address information;
step S330, the first private network address is determined according to the subscription information.
Specifically, the encrypted coin detection device can acquire address information of abnormal electricity user information from the electric operator through a first preset mode, actively acquire subscriber information corresponding to the address information from the user database module according to the address information, and then determine a first private network address according to the subscriber information. The encrypted coin detection device can acquire a first private network address corresponding to the abnormal electricity utilization user information through a first preset mode, and can actively detect the user node suspected of the encrypted coin mining behavior.
In an embodiment, when the electric operator finds a user using abnormal electricity, the address information of the user is provided to the telecom operator, the address information is acquired by the cryptocoin detecting device, the subscriber information corresponding to the address information is acquired from the AAA according to the address information, and the first private network address is determined according to the subscriber information. The encrypted coin detection device can acquire a first private network address corresponding to the abnormal electricity utilization user information through a first preset mode, and can actively detect the user node suspected of the encrypted coin mining behavior.
It should be noted that, in an embodiment, an industry application device is newly added to the core network of the fixed network, and a cryptographic coin detection device is deployed in the industry application device, where the cryptographic coin detection device may include a plurality of mining protocols of a simplified version of cryptographic coin, such as P2P functions of only reserving monitoring, querying nodes, establishing links, and the like.
It should be noted that, the first preset mode of the embodiment has the advantages of real-time detection capability, short detection time and high efficiency, the first preset mode does not need to introduce IPDR, can effectively protect user privacy, and does not need to deploy deep packet inspection technology (Deep Packet Inspection, DPI) to analyze the user internet code stream, so that the deployment cost is low.
In one embodiment, as shown in fig. 4, step S330 includes, but is not limited to, the following steps S410, S420 and S430.
Step S410, determining user number information from the subscriber information;
step S420, access information corresponding to the user number information is obtained according to the user number information;
step S430, determining a first private network address according to the access information.
The AAA provides an external interface inquiring capability, has the capability of inquiring user access information of the user through user number information, including an allocated private network address and the like, the encrypted coin detecting device has the capability of accessing an AAA open interface, acquiring the private network address and port information of the user through the interface, determining the user number information from subscription user information, then obtaining access information corresponding to the user number information from the AAA according to the user number information, and then determining a first private network address according to the access information.
In one embodiment, as shown in fig. 5, step S400 is followed by, but not limited to, step S510 below.
And S510, determining target user information from the abnormal electricity utilization user information according to the second private network address, wherein the target user information represents the user with the encrypted coin mining behavior.
Specifically, after the second private network address is determined, the encrypted coin detection device can determine target user information from abnormal electricity user information according to the second private network address, and because the second private network address is confirmed by the encrypted coin detection device through checking the first private network address and sending the encrypted coin detection message, the user node where the encrypted coin mining behavior really occurs can be accurately determined, and the efficiency of striking the mining behavior is improved.
In an embodiment, as shown in fig. 6, in the case that the preset mode is a second preset mode for acquiring a private network address corresponding to a user node in a public network address including the encrypted coin broadcasting information in the transmitted information, step S100 includes, but is not limited to, the following steps S610, S620 and S630.
Step S610, obtaining the encrypted coin broadcasting information through a second preset mode;
step S620, determining a public network address corresponding to the encrypted coin broadcasting information according to the encrypted coin broadcasting information;
step S630, a first private network address corresponding to the public network address is determined according to the public network address.
Specifically, the encrypted coin detecting device can acquire all the encrypted coin broadcasting information in the core network through a second preset mode, then determine a public network address corresponding to the encrypted coin broadcasting information according to the encrypted coin broadcasting information, and then determine one or more first private network addresses corresponding to the public network address according to the public network address. Namely, the encrypted coin detection device can acquire a first private network address corresponding to a user node in a public network address containing encrypted coin broadcasting information in the transmitted information through a second preset mode, so that the user node suspected of having encrypted coin mining behavior is passively detected, the suspicious user node is not required to be provided, and all mining nodes can be found.
In an embodiment, a cryptographic coin detection device is arranged in a core network, the cryptographic coin detection device is started in operation, all popular cryptographic coin broadcasting information in the core network is received through the cryptographic coin detection device, public network addresses and ports of message sources corresponding to the cryptographic coin broadcasting information are recorded, the cryptographic coin detection device inquires a first private network address and ports arranged under the public network addresses from an IPDR (network detail record module), namely, the cryptographic coin detection device can passively detect user nodes suspected to have cryptographic coin mining behaviors.
The step of obtaining the encrypted coin broadcasting information through the second preset mode may be that the area range to be detected is determined from the core network through the second preset mode, and then all the encrypted coin broadcasting information in the area range is obtained for the area range, so that the information of other areas outside the area range is not received; or may be obtained from all the encrypted coin broadcasting information in the core network, which is not particularly limited in this embodiment.
In one embodiment, as shown in fig. 7, step S400 is followed by steps S710 and S720, which are not limited to the following.
Step S710, obtaining user number information corresponding to the second private network address from the user database module according to the second private network address;
step S720, a user list with mining behaviors is generated according to the user number information.
Specifically, after the second private network address is determined, the encrypted coin detection device can acquire user number information corresponding to the second private network address from the user database module according to the second private network address, and then generate a user list with mining actions according to the user number information.
In addition, an embodiment of the present invention also provides a device for identifying a cryptographic coin mining behavior, the cryptographic coin mining behavior comprising:
the first acquisition module is used for acquiring a first private network address through a preset mode, wherein the first private network address is a private network address corresponding to a user node suspected of having a cryptographic coin mining behavior;
the sending module is used for sending the encrypted coin detection message to the first private network address;
the second acquisition module is used for acquiring the encrypted coin response information sent by the first private network address;
and the determining module is used for determining a second private network address from the first private network address according to the encrypted coin response information, wherein the second private network address is the private network address with the encrypted coin mining behavior.
In an embodiment, when the preset mode is a first preset mode for acquiring a private network address corresponding to a user node of the abnormal electricity consumption behavior, the first acquisition module is further configured to acquire address information of abnormal electricity consumption user information through the first preset mode; acquiring subscription user information corresponding to the address information from the user database module according to the address information; and determining a first private network address according to the subscription information.
In an embodiment, the first obtaining module is further configured to determine user number information from the subscriber information; obtaining access information corresponding to the user number information according to the user number information; and determining a first private network address according to the access information.
In an embodiment, the determining module is further configured to determine, according to the second private network address, target user information from the abnormal electricity utilization user information, where the target user information characterizes a user having a cryptographic coin mining behavior.
In an embodiment, the first obtaining module is further configured to obtain the encrypted coin broadcasting information through a second preset mode when the preset mode is a second preset mode for obtaining a private network address corresponding to a user node in the public network address including the encrypted coin broadcasting information in the transmitted information; determining a public network address corresponding to the encrypted coin broadcasting information according to the encrypted coin broadcasting information; and determining a first private network address corresponding to the public network address according to the public network address.
In an embodiment, the first obtaining module is further configured to query, from the network detailed record module, all first private network addresses corresponding to the public network address according to the public network address.
In an embodiment, the determining module is further configured to obtain, from the user database module according to the second private network address, user number information corresponding to the second private network address; and generating a user list with mining behaviors according to the user number information.
In an embodiment, the first obtaining module is further configured to determine, from the core network, a region range to be detected through a second preset mode; and acquiring all the encrypted coin broadcasting information in the area range.
It should be noted that the embodiments of the above-mentioned encrypted coin mining behavior recognition device and the encrypted coin mining behavior recognition method all belong to the same inventive concept, so that these embodiments have the same implementation principle and technical effects, and will not be described in detail herein.
In addition, an embodiment of the present invention also provides a cryptographic coin detecting apparatus including: memory, a processor, and a computer program stored on the memory and executable on the processor.
The processor and the memory may be connected by a bus or other means.
The memory, as a non-transitory computer readable storage medium, may be used to store non-transitory software programs as well as non-transitory computer executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, the memory optionally includes memory remotely located relative to the processor, the remote memory being connectable to the processor through a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
Note that the cryptocoin detecting apparatus in this embodiment may be applied to, for example, the cryptocoin detecting apparatus 110 in the embodiment shown in fig. 1, and the cryptocoin detecting apparatus in this embodiment can form a part of a system architecture in, for example, the embodiment shown in fig. 1, and these embodiments all belong to the same inventive concept, so these embodiments have the same implementation principle and technical effect, and will not be described in detail herein.
The non-transitory software program and instructions required to implement the cryptographic coin mining behavior recognition method of the above-described embodiment are stored in the memory, and when executed by the processor, the cryptographic coin mining behavior recognition method of the above-described embodiment is executed, for example, the method steps S100 to S400 in fig. 2, the method steps S310 to S330 in fig. 3, the method steps S410 to S430 in fig. 4, the method step S510 in fig. 5, the method steps S610 to S630 in fig. 6, and the method steps S710 to S720 in fig. 7 described above are executed.
Furthermore, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions that are executed by a processor or controller, for example, by one of the processors in the above-described communication device embodiments, and that cause the processor to perform the method of identifying the mining behavior of the above-described embodiment, for example, to perform the method steps S100 to S400 in fig. 2, the method steps S310 to S330 in fig. 3, the method steps S410 to S430 in fig. 4, the method steps S510 to S630 in fig. 5, and the method steps S710 to S720 in fig. 7 described above.
Those of ordinary skill in the art will appreciate that all or some of the steps, systems, and methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). The term computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data, as known to those skilled in the art. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital Versatile Disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. Furthermore, as is well known to those of ordinary skill in the art, communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media.
While the preferred embodiment of the present invention has been described in detail, the present invention is not limited to the above embodiment, and various equivalent modifications and substitutions can be made by those skilled in the art without departing from the spirit of the present invention, and these equivalent modifications and substitutions are intended to be included in the scope of the present invention as defined in the appended claims.
Claims (11)
1. A method for identifying a cryptographic coin mining behavior, which is applied to a cryptographic coin detection device, wherein the cryptographic coin detection device is arranged on a core network, and the method comprises the following steps:
acquiring a first private network address through a preset mode, wherein the first private network address is a private network address corresponding to a user node suspected to have a coin mining behavior;
sending a coin detection message to the first private network address;
obtaining the response information of the encrypted coin sent by the first private network address;
and determining a second private network address from the first private network address according to the encrypted coin response information, wherein the second private network address is the private network address with the encrypted coin mining behavior.
2. The method of claim 1, wherein the suspected presence of a crypto-coin mining action comprises at least one of:
abnormal electrical behavior;
the public address sends information including the behavior of the coin broadcasting information.
3. The method for identifying a cryptographic coin mining behavior according to claim 2, wherein the core network includes a user database module, and when the preset pattern is a first preset pattern of private network addresses corresponding to user nodes for acquiring abnormal electricity consumption behaviors, the acquiring the first private network addresses through the preset pattern includes:
acquiring address information of abnormal electricity user information through the first preset mode;
acquiring subscription user information corresponding to the address information from the user database module according to the address information;
and determining a first private network address according to the subscription information.
4. A method of identifying a cryptographic coin mining behavior according to claim 3, wherein said determining a first private network address based on said subscriber information comprises:
determining user number information from the subscriber information;
obtaining access information corresponding to the user number information according to the user number information;
and determining a first private network address according to the access information.
5. A method of identifying a cryptographic coin mining behavior according to claim 3, wherein after determining a second private network address from the first private network addresses based on the cryptographic coin response information, the method further comprises:
and determining target user information from the abnormal electricity utilization user information according to the second private network address, wherein the target user information represents a user with the encrypted coin mining behavior.
6. The method for recognizing a cryptographic coin mining behavior according to claim 2, wherein when the preset pattern is a second preset pattern for acquiring a private network address corresponding to a user node in the public network address including cryptographic coin broadcasting information in the transmitted information, the acquiring the first private network address through the preset pattern includes:
obtaining the encrypted coin broadcasting information through a second preset mode;
determining a public network address corresponding to the encrypted coin broadcasting information according to the encrypted coin broadcasting information;
and determining a first private network address corresponding to the public network address according to the public network address.
7. The method for identifying a cryptographic coin mining behavior according to claim 6, wherein the core network includes a network detail recording module, and the determining a first private network address corresponding to the public network address according to the public network address includes:
and inquiring all first private network addresses corresponding to the public network address from the network detailed recording module according to the public network address.
8. The method of claim 7, wherein the core network includes a subscriber database module, the method further comprising, after the determining a second private network address from the first private network address based on the cryptographic response information:
acquiring user number information corresponding to the second private network address from the user database module according to the second private network address;
and generating a user list with mining behaviors according to the user number information.
9. The method of claim 6, wherein the obtaining the encrypted coin broadcast information in the second preset mode comprises:
determining the region range to be detected from the core network through a second preset mode;
and acquiring all the encrypted coin broadcasting information in the area range.
10. A cryptographic coin detection device comprising: a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method for identifying a cryptographic coin mining behavior according to any one of claims 1 to 9 when executing the computer program.
11. A computer-readable storage medium storing computer-executable instructions for performing the encrypted coin mining behavior recognition method according to any one of claims 1 to 9.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111290067.XA CN116071057A (en) | 2021-11-02 | 2021-11-02 | Encrypted coin mining behavior recognition method, encrypted coin detection device and storage medium |
| PCT/CN2022/121416 WO2023077993A1 (en) | 2021-11-02 | 2022-09-26 | Crypto coin mining behavior recognition method, crypto coin detection apparatus, and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111290067.XA CN116071057A (en) | 2021-11-02 | 2021-11-02 | Encrypted coin mining behavior recognition method, encrypted coin detection device and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116071057A true CN116071057A (en) | 2023-05-05 |
Family
ID=86179108
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111290067.XA Pending CN116071057A (en) | 2021-11-02 | 2021-11-02 | Encrypted coin mining behavior recognition method, encrypted coin detection device and storage medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN116071057A (en) |
| WO (1) | WO2023077993A1 (en) |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11188899B2 (en) * | 2015-04-07 | 2021-11-30 | Dmg Blockchain Solutions Inc. | Off network identity tracking in anonymous cryptocurrency exchange networks |
| CN108563946A (en) * | 2018-04-17 | 2018-09-21 | 广州大学 | A kind of browser digs method, browser plug-in and the system of mine behavioral value |
| CN108829829A (en) * | 2018-06-15 | 2018-11-16 | 深信服科技股份有限公司 | Detect method, system, device and storage medium that ideal money digs mine program |
| CN110839088A (en) * | 2018-08-16 | 2020-02-25 | 深信服科技股份有限公司 | Detection method, system, device and storage medium for dug by virtual currency |
| CN111212039A (en) * | 2019-12-23 | 2020-05-29 | 杭州安恒信息技术股份有限公司 | Host mining behavior detection method based on DNS flow |
| CN111600850B (en) * | 2020-04-26 | 2021-09-07 | 武汉思普崚技术有限公司 | Method, equipment and storage medium for detecting mine digging virtual currency |
-
2021
- 2021-11-02 CN CN202111290067.XA patent/CN116071057A/en active Pending
-
2022
- 2022-09-26 WO PCT/CN2022/121416 patent/WO2023077993A1/en unknown
Also Published As
| Publication number | Publication date |
|---|---|
| WO2023077993A1 (en) | 2023-05-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108737430B (en) | Encryption communication method and system for block chain node | |
| CN108306893B (en) | Distributed intrusion detection method and system for ad hoc network | |
| KR100959459B1 (en) | Group judgment device | |
| CN107800678B (en) | Method and device for detecting abnormal registration of terminal | |
| CN107483419B (en) | Method, device and system for authenticating access terminal by server, server and computer readable storage medium | |
| CN103313429A (en) | Processing method for recognizing fabricated WIFI (Wireless Fidelity) hotspot | |
| JP4129216B2 (en) | Group judgment device | |
| TW201405354A (en) | Method and Apparatus of Identifying User Risk | |
| CN111447245A (en) | Authentication method, authentication device, electronic equipment and server | |
| CN108664395A (en) | Applied program testing method, device, equipment and storage medium | |
| KR102323712B1 (en) | Wips sensor and method for preventing an intrusion of an illegal wireless terminal using wips sensor | |
| US20080141369A1 (en) | Method, Device and Program for Detecting Address Spoofing in a Wireless Network | |
| BR102019020060A2 (en) | method for detecting access point characteristics using machine learning | |
| CN110768948A (en) | Vulnerability detection method and device, storage medium and electronic device | |
| CN114449064B (en) | Application identification method and device for TLS encrypted traffic and application identification equipment | |
| CN106790073B (en) | Blocking method and device for malicious attack of Web server and firewall | |
| CN107135190B (en) | Data flow attribution identification method and device based on transport layer secure connection | |
| CN108282551B (en) | Message identification processing method and device, monitoring equipment and readable storage medium | |
| CN107623916B (en) | Method and equipment for WiFi network security monitoring | |
| CN112422486B (en) | SDK-based safety protection method and device | |
| CN111405548B (en) | Fishing wifi detection method and device | |
| CN114697945B (en) | Method and device for generating discovery response message and method for processing discovery message | |
| CN116071057A (en) | Encrypted coin mining behavior recognition method, encrypted coin detection device and storage medium | |
| CN109587134B (en) | Method, apparatus, device and medium for secure authentication of interface bus | |
| CN111611574A (en) | Information acquisition method, device, equipment and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication |