WO2022222270A1 - 一种恶意挖矿行为识别方法、装置、设备及存储介质 - Google Patents

一种恶意挖矿行为识别方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2022222270A1
WO2022222270A1 PCT/CN2021/103572 CN2021103572W WO2022222270A1 WO 2022222270 A1 WO2022222270 A1 WO 2022222270A1 CN 2021103572 W CN2021103572 W CN 2021103572W WO 2022222270 A1 WO2022222270 A1 WO 2022222270A1
Authority
WO
WIPO (PCT)
Prior art keywords
behavior
wallet address
data
wallet
network connection
Prior art date
Application number
PCT/CN2021/103572
Other languages
English (en)
French (fr)
Inventor
郑云超
范渊
黄进
Original Assignee
杭州安恒信息技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US18/278,856 priority Critical patent/US20240137385A1/en
Application filed by 杭州安恒信息技术股份有限公司 filed Critical 杭州安恒信息技术股份有限公司
Publication of WO2022222270A1 publication Critical patent/WO2022222270A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/325—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices using wireless networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Definitions

  • the present invention relates to the field of computers, in particular to a malicious mining behavior identification method, device, equipment and storage medium.
  • malware mining is identified by detecting specific string features in traffic packets, but the features carried by different versions of mining programs with different protocols are uncertain, and may also be formatted by attackers. , which will lead to invalid detection; in the existing technology, it is also verified by identifying the mining pool address, but attackers generally do not choose to directly connect to popular mining pools with a high probability of being detected, and generally choose to let miners connect to mining pools
  • the proxy address is used for mining, and the proxy address of the mining pool is uncertain and cannot be accurately located, which reduces the accuracy of malicious mining behavior detection.
  • the purpose of the present invention is to provide a malicious mining behavior identification method, device, equipment and medium, which can improve the accuracy of malicious mining behavior identification. Its specific plan is as follows:
  • the present application discloses a malicious mining behavior identification method, including:
  • the extracting the wallet address from the operation data includes:
  • the preset wallet address detection rule is the key to detecting adjacent wallet addresses using regular matching Field detection rules.
  • the operation data corresponding to the target operation behavior is obtained, including:
  • the operation data is detected by using the preset wallet address detection rule corresponding to the target operation behavior to obtain the wallet address, including:
  • the content of the file is detected to obtain the wallet address.
  • the operation data corresponding to the target operation behavior is obtained, including:
  • the operation data is detected by using the preset wallet address detection rule corresponding to the target operation behavior to obtain the wallet address, including:
  • the process execution command parameter is detected to obtain the wallet address.
  • obtaining the externally accessed network connection behavior data, and judging whether there is a wallet address in the wallet address set in the network connection behavior data including:
  • the network connection behavior data includes access process information, access destination address and network traffic data packets;
  • the behavior corresponding to the network connection behavior data belongs to malicious mining behavior, including:
  • Malicious mining alarm information is generated based on the access process information in the network connection behavior data.
  • a malicious mining behavior identification device including:
  • an operation data acquisition module configured to acquire operation data corresponding to the target operation behavior when the target operation behavior is captured
  • a wallet address acquisition module used to extract the wallet address from the operation data to obtain a wallet address set
  • a judgment module configured to acquire externally accessed network connection behavior data, and determine whether there is a wallet address in the wallet address set in the network connection behavior data;
  • the behavior judgment module is used to judge that the behavior corresponding to the network connection behavior data belongs to malicious mining behavior if the judgment result of the judgment module is existence.
  • the wallet address acquisition module includes:
  • a wallet address detection unit configured to detect the operation data by using a preset wallet address detection rule corresponding to the target operation behavior to obtain the wallet address; wherein, the preset wallet address detection rule is to use a regular Matches detection rules that detect adjacent key fields of wallet addresses.
  • an electronic device comprising:
  • the processor is configured to execute the computer program to implement the aforementioned method for identifying malicious mining behavior.
  • the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program implements the aforementioned malicious mining behavior identification method when the computer program is executed by a processor.
  • the operation data corresponding to the target operation behavior is obtained; the wallet address is extracted from the operation data to obtain the wallet address set; the network connection behavior data accessed externally is obtained, and Determine whether there is a wallet address in the wallet address set in the network connection behavior data; if so, determine that the behavior corresponding to the network connection behavior data belongs to malicious mining behavior. It can be seen that by extracting the wallet address in the operation data corresponding to the target operation behavior, and monitoring the network connection behavior data, if it is found that the network connection behavior data contains the wallet address, it can be confirmed that the process corresponding to the traffic data is performing mining behavior. Since the wallet address is the necessary information for obtaining income, the malicious mining behavior is identified by using the wallet address used for logging in during mining, which improves the ability to identify malicious mining behaviors.
  • Fig. 1 is a flowchart of a malicious mining behavior identification method provided by the present application
  • Fig. 3 is a kind of concrete operation data schematic diagram provided by this application.
  • FIG. 6 is a schematic structural diagram of a malicious mining behavior identification device provided by the present application.
  • FIG. 7 is a structural diagram of an electronic device provided by the present application.
  • mining identification is performed by detecting specific string features in traffic packets, but the features carried by different versions of mining programs of different protocols are uncertain, and may also be formatted by attackers. As a result, the detection will be invalid; in the existing technology, it is also verified by identifying the mining pool address, and attackers generally do not choose to directly connect to popular mining pools with a high probability of being detected, but generally choose to let the mining machine connect to the mining pool proxy.
  • the proxy address of the mining pool is uncertain and cannot be accurately located, which reduces the accuracy of malicious mining behavior detection.
  • the present application proposes a malicious mining behavior identification method, which can improve the accuracy of malicious mining behavior identification.
  • the embodiment of the present application discloses a method for identifying malicious mining behavior.
  • the method may include the following steps:
  • Step S11 When the target operation behavior is captured, obtain operation data corresponding to the target operation behavior.
  • the operation behavior of the local operating system is first captured.
  • the target operation behavior is captured, the operation data corresponding to the above target operation behavior is obtained.
  • the wallet address of mining exists in the operation data corresponding to this type of operation behavior, so when these types of operation behaviors are captured, the operation data corresponding to the operation behavior is obtained.
  • the above target operation behaviors may include, but are not limited to, file modification behaviors, process creation behaviors, and the like.
  • Step S12 Extract the wallet address from the operation data to obtain a wallet address set.
  • the wallet address for mining is extracted from the above operation data to obtain a wallet address set.
  • the extracting the wallet address from the operation data may include: using a preset wallet address detection rule corresponding to the target operation behavior to detect the operation data to obtain the wallet address;
  • the preset wallet address detection rule is a detection rule that uses regular matching to detect adjacent key fields of wallet addresses. It can be understood that for different types of operation data generated by different types of operation behaviors, different wallet address detection rules are preset according to the characteristics of the operation data, and then after the operation data is obtained, the preset wallet address corresponding to the operation type is used. The detection rule detects the above operation data to extract the wallet address.
  • the above-mentioned preset wallet address detection rules can be detection rules that use regular matching to detect adjacent key fields of wallet addresses. For example, according to the characteristics of operation data, the wallet address is located after some specific fields, so specific target key fields are detected through regular matching. Then determine the location of the wallet address for withdrawal.
  • Step S13 Acquire externally accessed network connection behavior data, and determine whether there is a wallet address in the wallet address set in the network connection behavior data.
  • the network external connection behavior data generated during local external access is collected, and then according to the above wallet address set, it is determined whether any wallet address in the above wallet address set exists in the above network external connection behavior data.
  • Step S14 If there is, it is determined that the behavior corresponding to the network connection behavior data belongs to malicious mining behavior.
  • the above-mentioned network connection behavior data may be behavior data of hackers helping themselves to mine by invading the server to control the server.
  • the behavior corresponding to the network connection behavior data belongs to malicious mining behavior.
  • the operation data corresponding to the target operation behavior is obtained; the wallet address is extracted from the operation data to obtain the wallet address set; the external network connection for external access is obtained.
  • Behavior data and determine whether there is a wallet address in the wallet address set in the network connection behavior data; if there is, it is determined that the behavior corresponding to the network connection behavior data belongs to malicious mining behavior. It can be seen that by extracting the wallet address in the operation data corresponding to the target operation behavior, and monitoring the network connection behavior data, if it is found that the network connection behavior data contains the wallet address, it can be confirmed that the process corresponding to the traffic data is performing mining behavior. Since the wallet address is the necessary information for obtaining income, the malicious mining behavior is identified by using the wallet address used for logging in during mining, which improves the ability and accuracy of malicious mining behavior identification.
  • the embodiment of the present application discloses a specific malicious mining behavior identification method, as shown in FIG. 2 , the method may include the following steps:
  • Step S21 When the file modification behavior is captured, the file content of the modified file is acquired.
  • the file modification behavior is captured, the file content of the modified file corresponding to the file modification behavior is obtained. It can be understood that the above-mentioned file modification behavior is the target operation behavior in the previous embodiment, and the above-mentioned file content It is the operation data.
  • Step S22 Use the first preset wallet address detection rule corresponding to the file modification behavior to detect the content of the file to obtain a wallet address.
  • the first preset wallet address detection rule corresponding to the file modification behavior is used to detect the above-mentioned file content, and the wallet address in the file content is extracted and obtained.
  • the first preset wallet address detection rule may be a detection rule that uses regular matching to detect adjacent key fields of wallet addresses, that is, according to data rules, a specific target key field is obtained through regular matching to determine the location of the wallet address, and then extract the location of the wallet address.
  • the wallet address is obtained.
  • the wallet address in the file content may appear after the "login" field. Therefore, the adjacent key fields in the above-mentioned first preset wallet address detection rule may include the field "login".
  • Step S23 When the process creation behavior is captured, acquire the process execution command parameters corresponding to the process creation behavior.
  • the process execution command parameters corresponding to the process creation behavior are obtained. It can be understood that the above process creation behavior is the target operation behavior in the previous embodiment, and the above process execution command parameters It is the operation data.
  • Step S24 Use the second preset wallet address detection rule corresponding to the process creation behavior to detect the process execution command parameters to obtain the wallet address.
  • the second preset wallet address detection rule corresponding to the process creation behavior is used to detect the process execution command parameters, and the wallet address in the process execution command parameters is extracted and obtained.
  • the above-mentioned second preset wallet address detection rule may be a detection rule that uses regular matching to detect adjacent key fields of wallet addresses, that is, according to data rules, a specific target key field is obtained through regular matching to determine the location of the wallet address, and then extract the location of the wallet address.
  • Obtain the wallet address as shown in Figure 3, the wallet address may appear after the "-u" field in the process execution command parameters, so the adjacent key fields in the second preset wallet address detection rule above may include the field "-u" .
  • Step S25 Acquire externally accessed network connection behavior data, and determine whether there is a wallet address in the wallet address set in the network connection behavior data.
  • Step S26 If there is, it is determined that the behavior corresponding to the network connection behavior data belongs to malicious mining behavior.
  • the file modification behavior when the file modification behavior is captured, the file content of the modified file is obtained, and then the first preset wallet address detection rule corresponding to the file modification behavior is used to detect the file content. to obtain the wallet address; when the process creation behavior is captured, the process execution command parameters corresponding to the process creation behavior are obtained, and then the second preset wallet address detection rule corresponding to the process creation behavior is used to detect the process Execute the command parameter for detection to get the wallet address.
  • the new modification behavior and process creation behavior of the file are added by monitoring, and the file content and process execution command line parameters are extracted from the monitoring behavior, and then the wallet address is obtained from the detection rule, and the behavior data of the network connection is monitored. If the wallet address is included in the external connection behavior data, it is confirmed that the corresponding process is executing malicious mining behavior, which improves the accuracy of malicious mining behavior identification.
  • the embodiment of the present application discloses a specific malicious mining behavior identification method, as shown in FIG. 4 , the method may include the following steps:
  • Step S31 When the target operation behavior is captured, obtain operation data corresponding to the target operation behavior.
  • Step S32 Extract the wallet address from the operation data to obtain a wallet address set.
  • Step S33 Acquire the network connection behavior data of external access; the network connection behavior data includes access process information, access destination address and network traffic data packets.
  • the network external connection behavior data of local external access is collected, that is, the corresponding network external connection behavior data generated during external access. Accessed network traffic packets.
  • Step S34 Screen the network traffic data packets according to a preset data packet length threshold to obtain filtered data packets, and determine whether there is a wallet address in the wallet address set in the filtered data packets.
  • the network traffic data packets in the above-mentioned network connection behavior data are screened according to the preset data packet length threshold, and the filtered data packets are obtained.
  • the wallet address of mining is in the network traffic data packet, and the mining login traffic data packet is at least 100 bytes or more, so the above preset data packet length threshold can be 100 bytes, that is, the network traffic data can be obtained.
  • the data packets whose total length is less than 100 bytes are filtered out to obtain the filtered data packets, and then it is judged whether there is a wallet address in the wallet address set in the filtered data packets. Therefore, by screening network traffic data packets in terms of data size and then judging whether there is a wallet address, the subsequent workload is reduced and the efficiency of wallet address detection is improved.
  • Step S35 If there is a wallet address in the wallet address set in the filtered data packet, it is determined that the behavior corresponding to the network connection behavior data belongs to malicious mining behavior.
  • the access at this time may be a mining login request.
  • Step S36 Generate malicious mining alarm information based on the access process information in the network connection behavior data.
  • malicious mining alarm information is generated based on the access process information in the above-mentioned network connection behavior data. That is, after judging that it belongs to malicious mining behavior, the process information that initiates the access is extracted from the network external connection behavior data, and then the mining behavior of the process is sent to the corresponding alarm module to remind the user of the terminal that the terminal is suffering from malicious mining. attack.
  • the network connection behavior data obtained for external access includes access process information, access destination address and network traffic data packets, and then the network traffic data packets are screened according to the preset data packet length threshold, Obtain the filtered data packet, and judge whether there is a wallet address in the wallet address set in the filtered data packet; and after judging that the current behavior is malicious mining behavior, based on the network connection behavior data Access process information to generate malicious mining alarm information.
  • the network traffic data packets are screened by the preset data packet length threshold, which improves the speed of wallet address detection, and generates malicious mining alarm information based on the corresponding access process information to remind the administrator that there is a process of malicious mining behavior. .
  • the embodiment of the present application also discloses a malicious mining behavior identification device, as shown in FIG. 6 , the device includes:
  • the operation data acquisition module 11 is used for acquiring operation data corresponding to the target operation behavior when the target operation behavior is captured;
  • the wallet address obtaining module 12 is used for extracting the wallet address from the operation data to obtain the wallet address set;
  • Judging module 13 configured to obtain externally accessed network connection behavior data, and determine whether there is a wallet address in the wallet address set in the network connection behavior data;
  • the behavior determination module 14 is used to determine that the behavior corresponding to the network connection behavior data belongs to malicious mining if the determination result of the determination module is existence.
  • the operation data corresponding to the target operation behavior is obtained; the wallet address is extracted from the operation data to obtain the wallet address set; the external network connection for external access is obtained.
  • Behavior data and determine whether there is a wallet address in the wallet address set in the network connection behavior data; if there is, it is determined that the behavior corresponding to the network connection behavior data belongs to malicious mining behavior. It can be seen that by extracting the wallet address in the operation data corresponding to the target operation behavior, and monitoring the network connection behavior data, if it is found that the network connection behavior data contains the wallet address, it can be confirmed that the process corresponding to the traffic data is performing mining behavior. Since the wallet address is necessary information for obtaining income, the wallet address used for logging in during mining is used to identify malicious mining behaviors, which improves the accuracy of malicious mining behavior identification.
  • the wallet address obtaining module 12 may specifically include:
  • a wallet address detection unit configured to detect the operation data by using a preset wallet address detection rule corresponding to the target operation behavior to obtain the wallet address; wherein, the preset wallet address detection rule is to use a regular Matches detection rules that detect adjacent key fields of wallet addresses.
  • the operation data acquisition module 11 may specifically include:
  • a file content acquisition unit configured to acquire the file content of the modified file to obtain the operation data when the file modification behavior is captured
  • the process execution command parameter acquisition unit is configured to acquire process execution command parameters corresponding to the process creation behavior when the process creation behavior is captured, so as to obtain the operation data.
  • the wallet address detection unit may specifically include:
  • a first wallet address detection unit configured to use the first preset wallet address detection rule corresponding to the file modification behavior to detect the content of the file to obtain the wallet address
  • the second wallet address detection unit is configured to use the second preset wallet address detection rule corresponding to the process creation behavior to detect the process execution command parameters to obtain the wallet address.
  • the judging module 13 may specifically include:
  • a network external connection behavior data acquisition unit used for acquiring externally accessed network external connection behavior data
  • the network external connection behavior data includes access process information, access destination address and network traffic data packets
  • a screening unit configured to screen the network traffic data packets according to a preset data packet length threshold to obtain filtered data packets
  • a wallet address determination unit configured to determine whether there is a wallet address in the wallet address set in the filtered data packet.
  • the behavior determination module 14 may specifically include:
  • a behavior determination unit configured to determine that the behavior corresponding to the network connection behavior data belongs to malicious mining if there is a wallet address in the wallet address set in the filtered data packet;
  • An alarm unit configured to generate malicious mining alarm information based on the access process information in the network external connection behavior data.
  • the embodiment of the present application also discloses an electronic device, as shown in FIG. 7 , the content in the figure should not be considered as any limitation on the scope of use of the present application.
  • FIG. 7 is a schematic structural diagram of an electronic device 20 according to an embodiment of the present application.
  • the electronic device 20 may specifically include: at least one processor 21 , at least one memory 22 , a power supply 23 , a communication interface 24 , an input and output interface 25 and a communication bus 26 .
  • the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the malicious mining behavior identification method disclosed in any of the foregoing embodiments.
  • the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20;
  • the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is applicable Any communication protocol in the technical solution of the present application is not specifically limited here;
  • the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, here No specific limitation is made.
  • the memory 22 as a carrier for resource storage, can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored on it include an operating system 221, a computer program 222, and data 223 including operation data, etc.
  • the method can be short-term storage or permanent storage.
  • the operating system 221 is used to manage and control each hardware device and computer program 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux etc.
  • the computer program 222 may further include a computer program that can be used to complete other specific tasks in addition to the computer program that can be used to complete the malicious mining behavior identification method performed by the electronic device 20 disclosed in any of the foregoing embodiments.
  • an embodiment of the present application further discloses a computer storage medium, where computer-executable instructions are stored in the computer storage medium, and when the computer-executable instructions are loaded and executed by a processor, the disclosure of any of the foregoing embodiments is realized.
  • the steps of the malicious mining behavior identification method are realized.
  • the steps of a method or algorithm described in connection with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two.
  • the software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Theoretical Computer Science (AREA)
  • Strategic Management (AREA)
  • Finance (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

一种恶意挖矿行为识别方法、装置、设备及存储介质。该方法包括：当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据(S11)；从所述操作数据中提取钱包地址，得到钱包地址集(S12)；获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址(S13)；若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为(S14)。该方法通过提取目标操作行为对应的操作数据中的钱包地址，并监控网络外连行为数据中是否含有相应的钱包地址，判断是否存在恶意挖矿行为，由于钱包地址是获取收益的必备信息，因此利用挖矿时用于登录的钱包地址对恶意挖矿行为进行识别，提高了恶意挖矿行为识别的准确性。

Description

一种恶意挖矿行为识别方法、装置、设备及存储介质
本申请要求于2021年04月23日提交中国专利局、申请号为202110463363.9、发明名称为“一种恶意挖矿行为识别方法、装置、设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及计算机领域，特别涉及一种恶意挖矿行为识别方法、装置、设备及存储介质。
背景技术
目前，随着区块链的不断发展，很多人通过挖矿获取比特币以获取利润。比特币系统每隔一个时间点会在系统节点上生成一个随机代码，互联网中的所有计算机都可以去寻找此代码，谁找到此代码就会产生一个区块，而每促成一个区块的生成比特币该节点便获得相应奖励，这样大家就有动力投入资金去维护整个交易网络的正常运行，这个寻找代码获得奖励的过程就是挖矿。但是挖矿中要计算出符合条件的值需要大量运算，于是部分黑客就会通过入侵服务器的方式来控制别人的计算机帮助自己挖矿。
现有技术中，通过检测流量包里特定的字符串特征来进行恶意挖矿识别，但不同的协议不同版本的挖矿程序所携带的特征存在不确定性，同时也可能被攻击者进行格式修改，从而会导致检测无效；现有技术中还通过识别挖矿矿池地址来验证，但攻击者一般不会选择直接连接被检测概率较高的热门矿池，一般会选择让矿机连接矿池代理地址来进行挖矿，且矿池代理地址存在不确定性，无法准确定位，降低了恶意挖矿行为检测的准确性。
发明内容
有鉴于此，本发明的目的在于提供一种恶意挖矿行为识别方法、装置、设备及介质，能够提高恶意挖矿行为识别的准确性。其具体方案如下：
第一方面，本申请公开了一种恶意挖矿行为识别方法，包括：
当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据；
从所述操作数据中提取钱包地址，得到钱包地址集；
获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址；
若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。
可选的，所述从所述操作数据中提取钱包地址，包括：
利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址；其中，所述预设钱包地址检测规则为利用正则匹配检测钱包地址相邻关键字段的检测规则。
可选的，所述当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据，包括：
当捕获到文件修改行为，则获取被修改文件的文件内容以得到所述操作数据；
相应的，所述利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址，包括：
利用与所述文件修改行为对应的第一预设钱包地址检测规则，对所述文件内容进行检测以得到所述钱包地址。
可选的，所述当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据，包括：
当捕获到进程创建行为，则获取与所述进程创建行为对应的进程执行命令参数，以得到所述操作数据；
相应的，所述利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址，包括：
利用与所述进程创建行为对应的第二预设钱包地址检测规则，对所述进程执行命令参数进行检测以得到所述钱包地址。
可选的，所述获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址，包括：
获取对外访问的网络外连行为数据；所述网络外连行为数据包括访问 进程信息、访问目的地址和网络流量数据包；
根据预设数据包长度阈值对所述网络流量数据包进行筛选，得到筛选后数据包；
判断所述筛选后数据包中是否存在所述钱包地址集中的钱包地址。
可选的，所述若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为，包括：
若所述筛选后数据包中存在所述钱包地址集中的钱包地址，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为；
基于所述网络外连行为数据中的所述访问进程信息生成恶意挖矿告警信息。
第二方面，本申请公开了一种恶意挖矿行为识别装置，包括：
操作数据获取模块，用于当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据；
钱包地址获取模块，用于从所述操作数据中提取钱包地址，得到钱包地址集；
判断模块，用于获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址；
行为判定模，用于若所述判断模块的判断结果为存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。
可选的，所述钱包地址获取模块，包括：
钱包地址检测单元，用于利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址；其中，所述预设钱包地址检测规则为利用正则匹配检测钱包地址相邻关键字段的检测规则。
第三方面，本申请公开了一种电子设备，包括：
存储器，用于保存计算机程序；
处理器，用于执行所述计算机程序，以实现前述的恶意挖矿行为识别方法。
第四方面，本申请公开了一种计算机可读存储介质，用于存储计算机 程序；其中计算机程序被处理器执行时实现前述的恶意挖矿行为识别方法。
本申请中，当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据；从所述操作数据中提取钱包地址，得到钱包地址集；获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址；若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。可见，通过提取目标操作行为对应的操作数据中的钱包地址，并监控网络外连行为数据，如果发现网络外连行为数据中包含钱包地址，则可以确认该流量数据对应进程在执行挖矿行为，由于钱包地址是获取收益的必备信息，因此利用挖矿时用于登录的钱包地址对恶意挖矿行为进行识别，提高了恶意挖矿行为识别的能力。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图。
图1为本申请提供的一种恶意挖矿行为识别方法流程图；
图2为本申请提供的一种具体的恶意挖矿行为识别方法流程图；
图3为本申请提供的一种具体的操作数据示意图；
图4为本申请提供的一种具体的恶意挖矿行为识别方法流程图；
图5为本申请提供的一种具体的恶意挖矿行为识别方法流程图；
图6为本申请提供的一种恶意挖矿行为识别装置结构示意图；
图7为本申请提供的一种电子设备结构图。
具体实施方式
现有技术中，通过检测流量包里特定的字符串特征来进行挖矿识别，但不同的协议不同版本的挖矿程序所携带的特征存在不确定性，同时也可能被攻击者进行格式修改，从而会导致检测无效；现有技术中还通过识别 挖矿矿池地址来验证，且攻击者一般不会选择直接连接被检测概率较高的热门矿池，一般会选择让矿机连接矿池代理地址来进行挖矿，但矿池代理地址存在不确定性，无法准确定位，降低了恶意挖矿行为检测的准确性。为克服上述技术问题，本申请提出一种恶意挖矿行为识别方法，能够提高恶意挖矿行为识别的准确性。
本申请实施例公开了一种恶意挖矿行为识别方法，参见图1所示，该方法可以包括以下步骤：
步骤S11：当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据。
本实施例中，首先对本地操作系统的操作行为进行捕获，当捕获到目标操作行为时，获取与上述目标操作行为对应的操作数据，可以理解的是，挖矿过程中会执行某些类型的操作，与这类操作行为对应的操作数据中存在挖矿的钱包地址，因此当捕获到这些类型的操作行为后，获取与该操作行为对应的操作数据。其中，上述目标操作行为可以包括但不限于文件修改行为和进程创建行为等。
步骤S12：从所述操作数据中提取钱包地址，得到钱包地址集。
本实施例中，得到上述操作数据后，从上述操作数据中提取出挖矿的钱包地址，得到钱包地址集。
本实施例中，所述从所述操作数据中提取钱包地址，可以包括：利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址；其中，所述预设钱包地址检测规则为利用正则匹配检测钱包地址相邻关键字段的检测规则。可以理解的是，对于不同类型的操作行为产生的不同类型的操作数据，根据操作数据的特征预设不同的钱包地址检测规则，然后在得到操作数据后，利用与操作类型对应的预设钱包地址检测规则对上述操作数据进行检测以提取出钱包地址。上述预设钱包地址检测规则可以为利用正则匹配检测钱包地址相邻关键字段的检测规则，如根据操作数据特点钱包地址位于某些特定字段之后，因此通过正则匹配检测出特定的目标关键字段然后确定出钱包地址的位置进行提取。
步骤S13：获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址。
本实施例中，收集本地对外访问时产生的网络外连行为数据，然后根据上述钱包地址集，判断上述网络外连行为数据中是否存在上述钱包地址集中的任意一个钱包地址。
步骤S14：若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。
本实施例中，若上述网络外连行为数据中存在上述钱包地址集中的钱包地址，则说明上述网路外连行为数据可能为黑客通过侵入服务器控制服务器帮自己挖矿的行为数据，因此判定上述网络外连行为数据对应的行为属于恶意挖矿行为。
由上可见，本实施例中当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据；从所述操作数据中提取钱包地址，得到钱包地址集；获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址；若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。可见，通过提取目标操作行为对应的操作数据中的钱包地址，并监控网络外连行为数据，如果发现网络外连行为数据中包含钱包地址，则可以确认该流量数据对应进程在执行挖矿行为，由于钱包地址是获取收益的必备信息，因此利用挖矿时用于登录的钱包地址对恶意挖矿行为进行识别，提高了恶意挖矿行为识别的能力和准确性。
本申请实施例公开了一种具体的恶意挖矿行为识别方法，参见图2所示，该方法可以包括以下步骤：
步骤S21：当捕获到文件修改行为，则获取被修改文件的文件内容。
本实施例中，若捕获到文件修改行为，则获取文件修改行为对应的被修改文件的文件内容，可以理解的是，上述文件修改行为即为上一实施例中的目标操作行为，上述文件内容即为操作数据。
步骤S22：利用与所述文件修改行为对应的第一预设钱包地址检测规 则，对所述文件内容进行检测以得到钱包地址。
本实施例中，得到上述文件内容后，利用与文件修改行为对应的第一预设钱包地址检测规则，对上述文件内容进行检测，提取得到文件内容中的钱包地址。其中上述第一预设钱包地址检测规则可以为利用正则匹配检测钱包地址相邻关键字段的检测规则，即根据数据规则通过正则匹配得到特定的目标关键字段确定出钱包地址的位置，进而提取得到钱包地址，如文件内容中钱包地址可能出现在“login”字段之后，因此上述第一预设钱包地址检测规则中的相邻关键字段可以包括字段“login”。
步骤S23：当捕获到进程创建行为，则获取与所述进程创建行为对应的进程执行命令参数。
本实施例中，若捕获到进程创建行为，则获取进程创建行为对应的进程执行命令参数，可以理解的是，上述进程创建行为即为上一实施例中的目标操作行为，上述进程执行命令参数即为操作数据。
步骤S24：利用与所述进程创建行为对应的第二预设钱包地址检测规则，对所述进程执行命令参数进行检测以得到钱包地址。
本实施例中，得到上述进程执行命令参数后，利用与进程创建行为对应的第二预设钱包地址检测规则，对上述进程执行命令参数进行检测，提取得到进程执行命令参数中的钱包地址。其中上述第二预设钱包地址检测规则可以为利用正则匹配检测钱包地址相邻关键字段的检测规则，即根据数据规则通过正则匹配得到特定的目标关键字段确定出钱包地址的位置，进而提取得到钱包地址，如图3所示进程执行命令参数中钱包地址可能出现在“-u”字段之后，因此上述第二预设钱包地址检测规则中的相邻关键字段可以包括字段“-u”。
步骤S25：获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在钱包地址集中的钱包地址。
步骤S26：若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。
其中，关于上述步骤S25、步骤S26的具体过程可以参考前述实施例公开的相应内容，在此不再进行赘述。
由上可见，本实施例中当捕获到文件修改行为，则获取被修改文件的文件内容，然后利用与所述文件修改行为对应的第一预设钱包地址检测规则，对所述文件内容进行检测以得到钱包地址；当捕获到进程创建行为，则获取与所述进程创建行为对应的进程执行命令参数，然后利用与所述进程创建行为对应的第二预设钱包地址检测规则，对所述进程执行命令参数进行检测以得到钱包地址。可见，通过监控对文件新增修改行为和进程创建行为，并从监控行为中提取出文件内容以及进程执行命令行参数，再按检测规则从中获取钱包地址，同时监控网络外连行为数据，如果网络外连行为数据中包含钱包地址，则确认对应进程在执行恶意挖矿行为，提高了恶意挖矿行为识别的准确性。
本申请实施例公开了一种具体的恶意挖矿行为识别方法，参见图4所示，该方法可以包括以下步骤：
步骤S31：当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据。
步骤S32：从所述操作数据中提取钱包地址，得到钱包地址集。
步骤S33：获取对外访问的网络外连行为数据；所述网络外连行为数据包括访问进程信息、访问目的地址和网络流量数据包。
本实施例中，收集本地对外访问的网络外连行为数据，即对外访问时产生的相应的网络外连行为数据，上述网络外连行为数据包括但不限于访问的进程信息、访问的目标地址和访问的网络流量数据包。
步骤S34：根据预设数据包长度阈值对所述网络流量数据包进行筛选，得到筛选后数据包，并判断所述筛选后数据包中是否存在所述钱包地址集中的钱包地址。
本实施例中，获取到上述网络外连行为数据后，根据预设数据包长度阈值对上述网络外连行为数据中的网络流量数据包进行筛选，得到筛选后数据包，可以理解的是，例如图5所示，挖矿的钱包地址在网络流量数据包中，并且挖矿登陆流量数据包至少在100字节以上，因此上述预设数据包长度阈值可以为100字节，即得到网络流量数据包后过滤掉数据包总长度在 100字节以下的数据包，得到筛选后数据包，然后判断筛选后数据包中是否存在钱包地址集中的钱包地址。由此，通过对网络流量数据包在数据大小方面进行筛选后再判断是否存在钱包地址，减少了后续的工作量提高了钱包地址检测的效率。
步骤S35：若所述筛选后数据包中存在所述钱包地址集中的钱包地址，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。
本实施例中，若筛选后数据包的内容中存在上述钱包地址集中的钱包地址，则判定上述网络外连行为数据对应的行为属于恶意挖矿行为，即判断数据内容是否存在钱包地址集合中的任一个钱包地址，如果存在，则确认这是一个挖矿流量，对应的行为即为恶意挖矿行为，此时的访问可能为挖矿登陆请求。
步骤S36：基于所述网络外连行为数据中的所述访问进程信息生成恶意挖矿告警信息。
本实施例中，判断属于恶意挖矿行为后，例如图5所示，基于上述网络外连行为数据中的访问进程信息生成恶意挖矿告警信息。即判断属于恶意挖矿行为后，从网络外连行为数据中提取出发起访问的进程信息，然后将该进程的挖矿行为发送给相应的告警模块以提醒终端的使用者终端正在遭受恶意挖矿攻击。
由上可见，本实施例中获取对外访问的网络外连行为数据中包括访问进程信息、访问目的地址和网络流量数据包，然后根据预设数据包长度阈值对所述网络流量数据包进行筛选，得到筛选后数据包，并判断所述筛选后数据包中是否存在所述钱包地址集中的钱包地址；并在判断当前行为属于恶意挖矿行为后，基于所述网络外连行为数据中的所述访问进程信息生成恶意挖矿告警信息。可见，通过预设数据包长度阈值对网络流量数据包进行筛选，提高了钱包地址检测的速度，并基于相应的访问进程信息生成恶意挖矿告警信息，以提示管理员存在恶意挖矿行为的进程。
相应的，本申请实施例还公开了一种恶意挖矿行为识别装置，参见图6所示，该装置包括：
操作数据获取模块11，用于当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据；
钱包地址获取模块12，用于从所述操作数据中提取钱包地址，得到钱包地址集；
判断模块13，用于获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址；
行为判定模14，用于若所述判断模块的判断结果为存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。
由上可见，本实施例中当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据；从所述操作数据中提取钱包地址，得到钱包地址集；获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址；若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。可见，通过提取目标操作行为对应的操作数据中的钱包地址，并监控网络外连行为数据，如果发现网络外连行为数据中包含钱包地址，则可以确认该流量数据对应进程在执行挖矿行为，由于钱包地址是获取收益的必备信息，因此利用挖矿时用于登录的钱包地址对恶意挖矿行为进行识别，提高了恶意挖矿行为识别的准确性。
在一些具体实施例中，所述钱包地址获取模块12具体可以包括：
钱包地址检测单元，用于利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址；其中，所述预设钱包地址检测规则为利用正则匹配检测钱包地址相邻关键字段的检测规则。
在一些具体实施例中，所述操作数据获取模块11具体可以包括：
文件内容获取单元，用于当捕获到文件修改行为，则获取被修改文件的文件内容以得到所述操作数据；
进程执行命令参数获取单元，用于当捕获到进程创建行为，则获取与所述进程创建行为对应的进程执行命令参数，以得到所述操作数据。
在一些具体实施例中，所述钱包地址检测单元具体可以包括：
第一钱包地址检测单元，用于利用与所述文件修改行为对应的第一预 设钱包地址检测规则，对所述文件内容进行检测以得到所述钱包地址；
第二钱包地址检测单元，用于利用与所述进程创建行为对应的第二预设钱包地址检测规则，对所述进程执行命令参数进行检测以得到所述钱包地址。
在一些具体实施例中，所述判断模块13具体可以包括：
网络外连行为数据获取单元，用于获取对外访问的网络外连行为数据；所述网络外连行为数据包括访问进程信息、访问目的地址和网络流量数据包；
筛选单元，用于根据预设数据包长度阈值对所述网络流量数据包进行筛选，得到筛选后数据包；
钱包地址判断单元，用于判断所述筛选后数据包中是否存在所述钱包地址集中的钱包地址。
在一些具体实施例中，所述行为判定模14具体可以包括：
行为判定单元，用于若所述筛选后数据包中存在所述钱包地址集中的钱包地址，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为；
告警单元，用于基于所述网络外连行为数据中的所述访问进程信息生成恶意挖矿告警信息。
进一步的，本申请实施例还公开了一种电子设备，参见图7所示，图中的内容不能被认为是对本申请的使用范围的任何限制。
图7为本申请实施例提供的一种电子设备20的结构示意图。该电子设备20，具体可以包括：至少一个处理器21、至少一个存储器22、电源23、通信接口24、输入输出接口25和通信总线26。其中，所述存储器22用于存储计算机程序，所述计算机程序由所述处理器21加载并执行，以实现前述任一实施例公开的恶意挖矿行为识别方法中的相关步骤。
本实施例中，电源23用于为电子设备20上的各硬件设备提供工作电压；通信接口24能够为电子设备20创建与外界设备之间的数据传输通道，其所遵循的通信协议是能够适用于本申请技术方案的任意通信协议，在此不对其进行具体限定；输入输出接口25，用于获取外界输入数据或向外界输出 数据，其具体的接口类型可以根据具体应用需要进行选取，在此不进行具体限定。
另外，存储器22作为资源存储的载体，可以是只读存储器、随机存储器、磁盘或者光盘等，其上所存储的资源包括操作系统221、计算机程序222及包括操作数据在内的数据223等，存储方式可以是短暂存储或者永久存储。
其中，操作系统221用于管理与控制电子设备20上的各硬件设备以及计算机程序222，以实现处理器21对存储器22中海量数据223的运算与处理，其可以是Windows Server、Netware、Unix、Linux等。计算机程序222除了包括能够用于完成前述任一实施例公开的由电子设备20执行的恶意挖矿行为识别方法的计算机程序之外，还可以进一步包括能够用于完成其他特定工作的计算机程序。
进一步的，本申请实施例还公开了一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令被处理器加载并执行时，实现前述任一实施例公开的恶意挖矿行为识别方法步骤。
本说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其它实施例的不同之处，各个实施例之间相同或相似部分互相参见即可。对于实施例公开的装置而言，由于其与实施例公开的方法相对应，所以描述的比较简单，相关之处参见方法部分说明即可。
结合本文中所公开的实施例描述的方法或算法的步骤可以直接用硬件、处理器执行的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
最后，还需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而 且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上对本发明所提供的一种恶意挖矿行为识别方法、装置、设备及介质进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (10)

  1. 一种恶意挖矿行为识别方法，其特征在于，包括：
    当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据；
    从所述操作数据中提取钱包地址，得到钱包地址集；
    获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址；
    若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。
  2. 根据权利要求1所述的恶意挖矿行为识别方法，其特征在于，所述从所述操作数据中提取钱包地址，包括：
    利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址；其中，所述预设钱包地址检测规则为利用正则匹配检测钱包地址相邻关键字段的检测规则。
  3. 根据权利要求2所述的恶意挖矿行为识别方法，其特征在于，所述当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据，包括：
    当捕获到文件修改行为，则获取被修改文件的文件内容以得到所述操作数据；
    相应的，所述利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址，包括：
    利用与所述文件修改行为对应的第一预设钱包地址检测规则，对所述文件内容进行检测以得到所述钱包地址。
  4. 根据权利要求2所述的恶意挖矿行为识别方法，其特征在于，所述当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据，包括：
    当捕获到进程创建行为，则获取与所述进程创建行为对应的进程执行命令参数，以得到所述操作数据；
    相应的，所述利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址，包括：
    利用与所述进程创建行为对应的第二预设钱包地址检测规则，对所述进程执行命令参数进行检测以得到所述钱包地址。
  5. 根据权利要求1至4任意一项所述的恶意挖矿行为识别方法，其特征在于，所述获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址，包括：
    获取对外访问的网络外连行为数据；所述网络外连行为数据包括访问进程信息、访问目的地址和网络流量数据包；
    根据预设数据包长度阈值对所述网络流量数据包进行筛选，得到筛选后数据包；
    判断所述筛选后数据包中是否存在所述钱包地址集中的钱包地址。
  6. 根据权利要求5所述的恶意挖矿行为识别方法，其特征在于，所述若存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为，包括：
    若所述筛选后数据包中存在所述钱包地址集中的钱包地址，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为；
    基于所述网络外连行为数据中的所述访问进程信息生成恶意挖矿告警信息。
  7. 一种恶意挖矿行为识别装置，其特征在于，包括：
    操作数据获取模块，用于当捕获到目标操作行为时，获取与所述目标操作行为对应的操作数据；
    钱包地址获取模块，用于从所述操作数据中提取钱包地址，得到钱包地址集；
    判断模块，用于获取对外访问的网络外连行为数据，并判断所述网络外连行为数据中是否存在所述钱包地址集中的钱包地址；
    行为判定模，用于若所述判断模块的判断结果为存在，则判定所述网络外连行为数据对应的行为属于恶意挖矿行为。
  8. 根据权利要求7所述的恶意挖矿行为识别装置，其特征在于，所述钱包地址获取模块，包括：
    钱包地址检测单元，用于利用与所述目标操作行为对应的预设钱包地址检测规则对所述操作数据进行检测，以得到所述钱包地址；其中，所述预设钱包地址检测规则为利用正则匹配检测钱包地址相邻关键字段的检测规则。
  9. 一种电子设备，其特征在于，包括：
    存储器，用于保存计算机程序；
    处理器，用于执行所述计算机程序，以实现如权利要求1至6任一项所述的恶意挖矿行为识别方法。
  10. 一种计算机可读存储介质，其特征在于，用于存储计算机程序；其中计算机程序被处理器执行时实现如权利要求1至6任一项所述的恶意挖矿行为识别方法。
PCT/CN2021/103572 2021-04-22 2021-06-30 一种恶意挖矿行为识别方法、装置、设备及存储介质 WO2022222270A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/278,856 US20240137385A1 (en) 2021-04-22 2021-06-29 Method and apparatus for identifying malicious mining behavior, and device and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110463363.9 2021-04-22
CN202110463363.9A CN113177791A (zh) 2021-04-23 2021-04-23 一种恶意挖矿行为识别方法、装置、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2022222270A1 true WO2022222270A1 (zh) 2022-10-27

Family

ID=76926688

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/103572 WO2022222270A1 (zh) 2021-04-22 2021-06-30 一种恶意挖矿行为识别方法、装置、设备及存储介质

Country Status (3)

Country Link
US (1) US20240137385A1 (zh)
CN (1) CN113177791A (zh)
WO (1) WO2022222270A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114513331B (zh) * 2022-01-06 2023-06-09 杭州薮猫科技有限公司 基于应用层通信协议的挖矿木马检测方法、装置及设备

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108829829A (zh) * 2018-06-15 2018-11-16 深信服科技股份有限公司 检测虚拟货币挖矿程序的方法、系统、装置及存储介质
CN108900496A (zh) * 2018-06-22 2018-11-27 杭州安恒信息技术股份有限公司 一种快速探测网站被植入挖矿木马的检测方法以及装置
KR20190131745A (ko) * 2018-05-17 2019-11-27 한양대학교 산학협력단 악성 마이닝 동작 탐지 방법 및 그 시스템
CN110619217A (zh) * 2019-09-18 2019-12-27 杭州安恒信息技术股份有限公司 恶意挖矿程序主动防御的方法及装置
CN110839088A (zh) * 2018-08-16 2020-02-25 深信服科技股份有限公司 一种被虚拟货币挖矿的检测方法、系统、装置及存储介质
US20200387597A1 (en) * 2019-06-07 2020-12-10 Acronis International Gmbh System and method of detecting unauthorized access to computing resources for cryptomining
CN112087414A (zh) * 2019-06-14 2020-12-15 北京奇虎科技有限公司 挖矿木马的检测方法及装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20190131745A (ko) * 2018-05-17 2019-11-27 한양대학교 산학협력단 악성 마이닝 동작 탐지 방법 및 그 시스템
CN108829829A (zh) * 2018-06-15 2018-11-16 深信服科技股份有限公司 检测虚拟货币挖矿程序的方法、系统、装置及存储介质
CN108900496A (zh) * 2018-06-22 2018-11-27 杭州安恒信息技术股份有限公司 一种快速探测网站被植入挖矿木马的检测方法以及装置
CN110839088A (zh) * 2018-08-16 2020-02-25 深信服科技股份有限公司 一种被虚拟货币挖矿的检测方法、系统、装置及存储介质
US20200387597A1 (en) * 2019-06-07 2020-12-10 Acronis International Gmbh System and method of detecting unauthorized access to computing resources for cryptomining
CN112087414A (zh) * 2019-06-14 2020-12-15 北京奇虎科技有限公司 挖矿木马的检测方法及装置
CN110619217A (zh) * 2019-09-18 2019-12-27 杭州安恒信息技术股份有限公司 恶意挖矿程序主动防御的方法及装置

Also Published As

Publication number Publication date
US20240137385A1 (en) 2024-04-25
CN113177791A (zh) 2021-07-27

Similar Documents

Publication Publication Date Title
CN109889547B (zh) 一种异常网络设备的检测方法及装置
CN109474575B (zh) 一种dns隧道的检测方法及装置
CN111600850B (zh) 一种检测挖矿虚拟货币的方法、设备及存储介质
US8516573B1 (en) Method and apparatus for port scan detection in a network
US20180083987A1 (en) System and method for generating rules for attack detection feedback system
US20110030059A1 (en) Method for testing the security posture of a system
CN110839088A (zh) 一种被虚拟货币挖矿的检测方法、系统、装置及存储介质
CN110784383A (zh) Shadowsocks代理网络流量检测方法、存储介质和终端
CN114124476B (zh) 一种Web应用的敏感信息泄露漏洞检测方法、系统及装置
WO2022222270A1 (zh) 一种恶意挖矿行为识别方法、装置、设备及存储介质
CN112839054A (zh) 一种网络攻击检测方法、装置、设备及介质
CN112422581A (zh) JVM中的Webshell网页检测方法、装置及设备
CN113726825B (zh) 一种网络攻击事件反制方法、装置及系统
CN115695031A (zh) 主机失陷检测方法、装置及设备
CN112822204A (zh) 一种nat的检测方法、装置、设备及介质
CN113852625B (zh) 一种弱口令监测方法、装置、设备及存储介质
JP2010250607A (ja) 不正アクセス解析システム、不正アクセス解析方法、および不正アクセス解析プログラム
CN113132316A (zh) 一种Web攻击检测方法、装置、电子设备及存储介质
CN113965392B (zh) 恶意服务器检测方法、系统、可读介质及电子设备
CN113965418B (zh) 一种攻击成功判定方法及装置
CN113810342B (zh) 一种入侵检测方法、装置、设备、介质
JP6602799B2 (ja) セキュリティ監視サーバ、セキュリティ監視方法、プログラム
KR102514214B1 (ko) 빅데이터를 이용한 인공지능형 네트워크 파밍 차단 방법 및 시스템
CN112565269B (zh) 服务器后门流量检测方法、装置、电子设备及存储介质
Shu et al. A formal methodology for network protocol fingerprinting

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21937494

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18278856

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21937494

Country of ref document: EP

Kind code of ref document: A1