KR102153035B1 - Method and apparatus for detecting malicious mining - Google Patents

Abstract

The method for detecting malicious mining motions provided by the present invention includes: a first detection step of monitoring an operation process of a mining program executed by receiving mining data from an API module of a user terminal connected to a mining pool server; A second detection step of checking whether a mining data format input to the API module in the first detection step matches a mining data format of a preset API module; And determining that the malicious mining program is running in the user terminal if the mining data format input to the API module in the second detection step matches the mining data format of the preset API module. There is this.
According to the present invention, there is an effect of preventing the spread of malicious code by detecting cryptojacking that performs mining in the background without the user's consent in the user's terminal.

Description

Malicious mining motion detection method and its system {METHOD AND APPARATUS FOR DETECTING MALICIOUS MINING}

The present invention relates to a malicious mining operation detection method and system thereof, and in particular, a malicious mining operation capable of preventing the spread of malicious codes by detecting Cryptojacking that performs mining in the background without the user's consent at a user's terminal. It relates to a detection method and a system thereof.

Recently, digital currency or virtual currency is a digitally implemented currency, and cryptocurrency based on encryption technology is widely known in recent years as a kind of such digital currency. Despite the fact that there are a few users and insufficient support by the state, the use of such digital currency is increasing due to the advantages of various transactions.

Such digital currency mining can be performed by anyone with computing equipment capable of running a cryptocurrency algorithm, but since the cryptocurrency process is not easy, relatively high-spec computing equipment is required, and malicious mining without user consent. It is difficult to prepare for malicious code that performs it.

In general, in anti-virus and operating systems, anti-virus programs of files or applications make a database of the list of malicious code signatures of known malicious behavior applications, and treatment and response are possible only when they are infected with malicious codes in the database. I did. Therefore, it is difficult to detect new malicious codes and malicious applications that are not already known, making it difficult to detect malicious codes early and to respond to malicious codes.

Korean Patent Publication 10-2015-0116477

An object of the present invention is to provide a method and a system for detecting a malicious mining operation capable of preventing the spread of malicious code by detecting Cryptojacking, which performs mining in the background without the user's consent in a user's terminal.

The problem to be solved by the present invention is not limited to the problem(s) mentioned above, and another problem(s) not mentioned will be clearly understood by those skilled in the art from the following description.

In order to solve the above problems, the method for detecting malicious mining motions provided by the present invention includes: a first detection step of monitoring an operation process of a mining program executed by receiving mining data from an API module of a user terminal connected to a mining pool server; A second detection step of checking whether a mining data format input to the API module in the first detection step matches a mining data format of a preset API module; And mining data input to the API module in the second detection step It is characterized in that it includes; determining that the malicious mining program is running in the user terminal if the format matches the mining data format of the preset API module.

Preferably, the operation of the mining program comprises: accessing the mining pool server to receive mining data of an API module; processing mining data of the received API module; of the T head designated by the mining program Creating a number of threads; Storing the processed mining data in the generated threads; And calculating a hash value by a hash function after storing the mining data.

Preferably, the API module is characterized in that it includes a plurality of APIs used in each step.

Preferably, each mining data used in the plurality of AIPs is characterized in that the format is data.

Preferably, the first detection step is characterized in that the mining operation is detected by analyzing the overall usage rate of the CPU of the user terminal and the occupied usage rate of each processor of the CPU.

Advantageously, it is characterized in that it is determined that a malicious mining operation is performed when the overall CPU utilization rate rapidly increases and a certain occupied utilization rate is maintained in one processor.

Preferably, it is characterized in that it is determined that a malicious mining operation is performed when the occupied utilization rate used by one processor is a multiple of 1/(the total number of threads in the CPU) * 100.

In addition, in order to solve the above problems, the malicious mining operation detection system provided by the present invention includes: a CPU that receives mining data from an API module of a user terminal connected to a mining pool server and executes a mining program; A monitoring unit for monitoring an operation of a mining program executed by the CPU; And a data inspection unit that checks whether the mining data format transmitted to the API module matches a preset mining data format.

Preferably, the monitoring unit connects to the mining pool server in the operation of the mining program executed by the CPU, receives the mining data of the API module, processes the mining data of the API module, and the number of T heads designated by the mining program It has a characteristic in that it detects the process of storing the processed mining data in the generated thread after creating a thread with and calculating a hash value by a hash function.

Preferably, the monitoring unit is characterized in that it detects a mining operation by analyzing the total usage rate of the CPU of the user terminal and the occupied usage rate of each processor of the CPU.

Advantageously, it is characterized in that it is determined that a malicious mining operation is performed when the overall CPU utilization rate rapidly increases and a certain occupied utilization rate is maintained in one processor.

Preferably, it is characterized in that it is determined that a malicious mining operation is performed when the occupied utilization rate used by one processor is a multiple of 1/(the total number of threads in the CPU) * 100.

According to the present invention, there is an effect of preventing the spread of malicious code by detecting cryptojacking that performs mining in the background without the user's consent in the user's terminal.

1 is a diagram schematically showing the overall configuration of a digital currency mining system of the present invention.
2 is a diagram schematically showing the configuration of a malicious mining motion detection system according to an embodiment of the present invention.
3 is a flowchart illustrating a method of detecting a malicious mining operation according to an embodiment of the present invention.
4 is a flowchart illustrating an operation process of the mining program of the present invention.

In the present invention, various modifications may be made and various embodiments may be provided, and specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to a specific embodiment, it is to be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention. In describing each drawing, similar reference numerals have been used for similar elements.

Terms such as first, second, A, and B may be used to describe various elements, but the elements should not be limited by the terms. These terms are used only for the purpose of distinguishing one component from another component. For example, without departing from the scope of the present invention, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element. The term and/or includes a combination of a plurality of related listed items or any of a plurality of related listed items.

When a component is referred to as being "connected" or "connected" to another component, it is understood that it may be directly connected or connected to the other component, but other components may exist in the middle. Should be. On the other hand, when a component is referred to as being "directly connected" or "directly connected" to another component, it should be understood that there is no other component in the middle.

The terms used in the present application are used only to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present application, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof does not preclude in advance.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and should not be interpreted as an ideal or excessively formal meaning unless explicitly defined in this application. Does not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram schematically showing the overall configuration of a digital currency mining system according to the present invention, and FIG. 2 is a diagram schematically showing a configuration of a malicious mining operation detection system according to an embodiment of the present invention.

As shown in FIG. 1, a digital currency mining system may include a mining pool server 100, a user terminal 200, and a digital wallet 300.

The user terminal 200 may access the mining pool server 100 through a communication network to sign up as a member and create a personal digital wallet (not shown). Then, the mining module provided by the mining pool server 100 may be downloaded and installed, and the mining operation provided by the mining pool server 100 may be performed, and the result may be transmitted to the mining pool server 100. The mining pool server 100 may divide the mining operation into small portions and distribute it to members, and collect the mining operation results received from the members so that a new digital currency is issued to the digital wallet 300. Thereafter, the mining pool server 100 may distribute digital currency from the server digital wallet 300 to the personal digital wallet according to the contribution of the members.

Such digital currency is managed through a digital wallet 300, and is generally implemented in software and stored in a storage device of a computer. The digital wallet 24 is a public key generated according to a predetermined encryption algorithm. key), which is used to specify the destination to which digital currency is to be transferred, such as an account number used in bank transfer transactions, ie, digital currency is from one person's digital wallet to another person's digital wallet. Hereinafter, “digital currency” means a digital currency based on encryption.

As such, there are various types of digital currency such as Bitcoin, Litecoin, Namecoin, and Peercoin depending on the encryption algorithm used.It is not issued by a specific individual or company, but anyone using computer equipment is a highly mathematical cryptocurrency. There is a common point that it can be obtained by solving. In other words, a specific digital currency system that manages the issuance of digital currency with a specific mathematical encryption algorithm is not a system operated by a specific individual or company, and the computers of all individuals who own the digital currency are connected through a communication network. It is a peer-to-peer (P2P) network. In other words, digital currency is managed through a digital currency system, which is a P2P network, and mining operations can be provided to mining modules performed on a personal computer. The mining operation is a mathematical operation that generates a hash value that meets the conditions suggested by the digital currency system. When the mining module performs the mining operation and transmits the hash found as a result of the mining operation to the digital currency system, the digital currency system issues a new digital currency to the digital wallet associated with the mining module that performed the mining operation. I can.

As shown in Figure 2, the malicious mining operation detection system according to an embodiment of the present invention, as configured in the user terminal 200, API module 210, CPU 220, monitoring unit 230, It is configured to include a data inspection unit 240 and a notification unit 250.

The API module 210 accesses the mining pool server 100 to receive an API for mining and mining data. Here, the API module 210 receives a plurality of application programming interfaces (APIs) used in each process of a mining operation, and data having a predetermined format is transmitted for each mining data used in the plurality of AIPs.

In other words, the API module 210 may pattern and store a list of a plurality of received APIs and an order of API calls.

The CPU 220 executes a mining program on the mining data transmitted from the API module 210.

More specifically, the CPU 220 executes a mining program to perform a mining operation, and the process of this mining operation accesses the mining pool server to receive mining data from the API module and processes the mining data of the API module. Then, after creating threads with the number of T heads designated by the mining program, the processed mining data is stored in the created threads, and a hash value is calculated by a hash function.

The monitoring unit 230 monitors each process of the mining operation process of the mining program executed by the CPU 220.

More specifically, the monitoring unit 230 detects a mining operation by analyzing the overall usage rate of the CPU 220 and the occupied usage rate of each processor of the CPU 220 in the user terminal. If the overall utilization rate of the CPU 220 rapidly increases and a certain occupied utilization rate is maintained in one processor, it may be determined as a malicious mining operation. For example, in a processor driving four CPUs, each usage rate rises to 50% each, or the usage rate is maintained exclusively in one processor. In other words, when the occupied utilization rate used by one processor of the CPU is a multiple of 1/(the total number of threads in the CPU) * 100, it is determined that a malicious mining operation is performed. That is, if a processor driving four CPUs uses one of the four exclusively, the utilization rate is 1/(4) * 100 = 50%, which is a multiple of the 25% utilization rate, can be determined as a mining operation. .

The data inspection unit 240 checks whether the mining data format transmitted to the API module 210 matches a preset mining data format.

More specifically, when the CPU performs a mining operation process, the data inspection unit 240 receives and performs data in a predetermined format to an API used in each process. At this time, a value for mining data having a certain format is stored, and when a mining process is performed, the mining data in each process is checked to detect a malicious mining process.

When the data inspection unit 240 detects that the malicious mining process is being performed, the notification unit 250 may provide a notification to the user terminal to block the malicious mining operation.

In addition, FIG. 3 is a flowchart illustrating a method of detecting a malicious mining operation according to an embodiment of the present invention, and FIG. 4 is a flowchart illustrating an operation process of a mining program according to the present invention.

As shown in FIG. 3, the method for detecting malicious mining motions provided by the present invention includes a first detection step of monitoring an operation process of a mining program executed by receiving mining data from an API module of a user terminal connected to a mining pool server. Is performed (S310). Here, a detailed description of the operation process of the mining program will be described with reference to FIG. 4 below.

The API module 210 receives a plurality of application programming interfaces (APIs) used in each process of a mining operation, and data having a predetermined format is transmitted to each of the mining data used in the plurality of AIPs. Here, the API module 210 may pattern and store a list of a plurality of received APIs and an order of API calls.

In addition, in the monitoring step, a mining operation is detected by analyzing the overall usage rate of the CPU of the user terminal and the occupied usage rate of each processor of the CPU.

More specifically, it is determined that a malicious mining operation is performed when the overall CPU usage rate rapidly increases and a certain occupied usage rate is maintained in one processor. In other words, for example, in a processor driving four CPUs, each usage rate rises to 50% and is maintained, or a constant usage rate is maintained exclusively in one processor. In other words, when the occupied utilization rate used by one processor of the CPU is a multiple of 1/(the total number of threads in the CPU) * 100, it is determined that a malicious mining operation is performed. That is, if a processor driving four CPUs uses one of the four exclusively, the utilization rate is 1/(4) * 100 = 50%, which is a multiple of the 25% utilization rate, can be determined as a mining operation. .

In the first detection step, a second detection step of checking whether a mining data format input to the API module matches a mining data format of a preset API module is performed (S320).

More specifically, the mining data corresponding to the API list in the API module has a certain format. At this time, each format data corresponding to the API used in each process is transmitted. For example, when connecting to a mining pool server and receiving data, {"id":null, "method": "mining.notify", "params":["...", "..."]}/ It is transmitted in n data format. And, when creating a thread, there is no data used separately, and the API call pattern is uniformly applied as EnterCriticalSection, GetCurrentThreadId ... LeaveCriticalSection, etc. as follows.

And, when setting the processed data to the created thread, the value of the JSON-RPC data item is applied, and when calculating the hash, the data in the Integer format is applied.

When data having a certain format used in the mining operation process is input, it is compared with a previously stored data format to check whether it matches.

Then, it is determined whether the mining data format input to the API module in the second detection step matches the mining data format of the preset API module (S330), and it is determined that a malicious mining program is running in the user terminal. (S340).

Subsequently, when it is detected that the malicious mining process is being performed, a step of providing a notification to the user terminal to block the malicious mining operation is performed (S350).

Meanwhile, as shown in FIG. 4, in the operation of the mining program, a step of accessing the mining pool server and receiving mining data of an API module is performed (S410). Here, as APIs used when accessing the mining pool server to receive data, strcpy, wcscpy, and _mbscpy may be included. For example, {"id":null, "method": "mining.notify", " params":["...", "..."]}/n constant data format is transmitted.

Subsequently, a step of processing mining data of the received API module is performed (S420). An API used when processing the transmitted data may include strtok, _strtok_l, wcstok, _wcstok_l, _mbstok, and _mbstok_l.

In addition, the step of creating threads with the number of T heads designated by the mining program is performed (S430). Here, when creating as many threads as the number of T heads, EnterCriticalSection, GetCurrentThreadId, and LeaveCriticalSection may be included.

Subsequently, the step of storing the processed mining data in the generated thread is performed (S440). Here, the API for storing processed data in the created thread may include strtol, strtoll, wcstol, _strtol_l, and _wcstol_l.

Then, after storing the mining data, a hash value is calculated by a hash function (S450). Here, RtlHashUnicodeString may be used as an API for calculating the hash value.

More specifically, the calculation of the hash value may be repeated until a hash value that satisfies a specific condition is found using, for example, a hash function corresponding to a one-way function.

So far, the present invention has been looked at around its preferred embodiments. Those of ordinary skill in the art to which the present invention pertains will be able to understand that the present invention may be implemented in a modified form without departing from the essential characteristics of the present invention. Therefore, the disclosed embodiments should be considered from an illustrative point of view rather than a limiting point of view. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope equivalent thereto should be construed as being included in the present invention.

110 --- Mining pool server 200 --- User terminal
210 --- API module 220 --- CPU
230 --- Monitoring unit 240 --- Data inspection unit
250 --- Notification unit 300 --- Digital wallet

Claims (12)

A first detection step of monitoring an operation process of a mining program executed by receiving mining data from an API module of a user terminal connected to the mining pool server;
A second detection step of checking whether a mining data format input to the API module in the first detection step matches a mining data format of a preset API module; And
If the mining data format input to the API module in the second detection step matches the mining data format of the preset API module, determining that a malicious mining program is running in the user terminal; and a malicious mining operation detection method comprising: .
The method of claim 1,
The operation process of the mining program,
Accessing the mining pool server to receive mining data of an API module;
Processing mining data of the received API module;
Creating threads with the number of T heads designated by the mining program;
Storing the processed mining data in the created thread; And
And calculating a hash value by a hash function after storing the mining data.
The method of claim 2,
The API module includes a plurality of APIs for performing each step included in the operation process of the mining program.
The method of claim 3,
Each of the mining data used in the plurality of APIs is data having a predetermined format.
The method of claim 1,
In the first detection step,
A method for detecting a malicious mining operation, comprising detecting a mining operation by analyzing a utilization rate of all processors constituting the CPU and a utilization rate of some processors constituting the CPU in a CPU composed of at least one processor.
The method of claim 5,
And determining that a malicious mining operation is performed when the utilization rate of the entire processor increases rapidly and the utilization rate of some of the processors is maintained.
The method of claim 5,
When the occupied utilization rate of the CPU used by the at least one processor is a multiple of 1/(the total number of threads of the CPU) * 100, it is determined that a malicious mining operation is performed.
A CPU that receives mining data from an API module of a user terminal connected to the mining pool server and executes a mining program;
A monitoring unit for monitoring an operation of a mining program executed by the CPU; And
Malicious mining operation detection system comprising a; a data inspection unit for checking whether the mining data format transmitted to the API module matches a preset mining data format.
The method of claim 8,
The monitoring unit,
In the operation of the mining program executed by the CPU, after accessing the mining pool server, receiving the mining data of the API module, processing the mining data of the API module, and creating a thread with the number of T heads designated by the mining program, A malicious mining operation detection system, characterized in that for storing the processed mining data in a generated thread, and detecting a process of calculating a hash value by a hash function.
The method of claim 8,
The monitoring unit,
A malicious mining operation detection system, characterized in that a CPU configured with at least one processor analyzes a utilization rate of all processors constituting the CPU and a utilization rate of some processors constituting the CPU to detect a mining operation.
The method of claim 10,
And determining that a malicious mining operation is performed when the utilization rate of the entire processor increases rapidly and the utilization rate of some of the processors is maintained.
The method of claim 10,
When the occupied utilization rate of the CPU used by the at least one processor is a multiple of 1/(the total number of threads of the CPU) * 100, it is determined that a malicious mining operation is performed.

Images