WO2023077993A1 - 加密币挖矿行为识别方法、加密币探测装置及存储介质 - Google Patents

加密币挖矿行为识别方法、加密币探测装置及存储介质 Download PDF

Info

Publication number
WO2023077993A1
WO2023077993A1 PCT/CN2022/121416 CN2022121416W WO2023077993A1 WO 2023077993 A1 WO2023077993 A1 WO 2023077993A1 CN 2022121416 W CN2022121416 W CN 2022121416W WO 2023077993 A1 WO2023077993 A1 WO 2023077993A1
Authority
WO
WIPO (PCT)
Prior art keywords
network address
private network
information
user
coin
Prior art date
Application number
PCT/CN2022/121416
Other languages
English (en)
French (fr)
Inventor
江舟
连超
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2023077993A1 publication Critical patent/WO2023077993A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/04—Payment circuits
    • G06Q20/06—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
    • G06Q20/065—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme using e-cash
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/04—Payment circuits
    • G06Q20/06—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3823—Payment protocols; Details thereof insuring higher security of transaction combining multiple encryption tools for a transaction
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the present application relates to the field of communication technology, in particular to a cryptographic currency mining behavior identification method, a cryptographic currency detection device and a storage medium.
  • the related method proposes to deploy a large number of bitcoin probes in the public network, and infer the identity information of the designated node by obtaining the bitcoin transaction information broadcast information, but because the network address is limited, a public network address is usually divided into many users. In addition, the public network address assigned to the user by the existing communication system is also constantly changing, so it is impossible to accurately locate a specific user based on the public network address information by this method.
  • Embodiments of the present application provide a cryptographic coin mining behavior identification method, a cryptographic coin detection device, and a storage medium.
  • the embodiment of the present application provides a cryptographic coin mining behavior identification method, which is applied to a cryptographic coin detection device, and the cryptographic coin detection device is set in the core network.
  • the method includes: obtaining the first Private network address, the first private network address is the private network address corresponding to the user node suspected to have encrypted currency mining behavior; send encrypted currency detection message to the first private network address; obtain information from the first private network address The encrypted currency response information sent by the private network address; according to the encrypted currency response information, determine the second private network address from the first private network address, and the second private network address is a private network with encrypted currency mining behavior. net address.
  • the embodiment of the present application also provides an encrypted currency detection device, including: a memory, a processor, and a computer program stored on the memory and operable on the processor, when the processor executes the computer program Realize the cryptocurrency mining behavior identification method as described in the first aspect above.
  • the embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to execute the encryption coin mining behavior identification method described in the first aspect above.
  • FIG. 1 is a schematic diagram of a system architecture for implementing a cryptographic currency mining behavior identification method provided by an embodiment of the present application
  • Fig. 2 is the flow chart of the encryption currency mining behavior identification method provided by one embodiment of the present application.
  • Fig. 3 is a flow chart of determining the first private network address through the first preset module in the encrypted currency mining behavior identification method provided by one embodiment of the present application;
  • Fig. 4 is a flow chart of further defining and determining the first private network address in the encrypted currency mining behavior identification method provided by an embodiment of the present application;
  • Fig. 5 is a flow chart of determining the target mining behavior user in the encrypted currency mining behavior identification method provided by an embodiment of the present application
  • Fig. 6 is a flow chart of determining the first private network address through the second preset module in the encrypted currency mining behavior identification method provided by an embodiment of the present application;
  • Fig. 7 is a flow chart of generating a list of mining behavior users in the method for identifying cryptocurrency mining behavior provided by an embodiment of the present application.
  • the present application provides a cryptographic currency mining behavior identification method, a cryptographic currency detection device, and a storage medium, wherein the cryptographic currency mining behavior identification method includes: obtaining a first private network address through a preset mode, and the first private network address is The private network address corresponding to the user node suspected of cryptocurrency mining behavior; send a cryptocurrency detection message to the first private network address; obtain the cryptocurrency response information sent from the first private network address; according to the cryptocurrency response information from The second private network address is determined in the first private network address, and the second private network address is a private network address where cryptocurrency mining behavior exists.
  • the encrypted currency detection device can obtain the first private network address with suspected encrypted currency behavior through the core network, and then send an encrypted currency detection message for the first private network address to confirm the existence of encrypted currency behavior Therefore, it can solve the problem that the specific user cannot be accurately located through the public network address information, thereby effectively improving the accuracy of the identification of cryptocurrency mining behavior.
  • FIG. 1 is a schematic diagram of a system architecture platform for implementing a cryptographic currency mining behavior identification method provided by an embodiment of the present application.
  • the system architecture platform is set in the core network, and the core network includes an encrypted currency detection device 110, a network detailed record module 120 connected with the encrypted currency detection device and a user database module 130 connected with the encrypted currency detection device,
  • the network detailed record module is used to provide the user query interface, and is used to query the public network address and private network address of the user corresponding to the public network address
  • the user database module is used to query the user's private network address capability, and is also used to obtain Specify the user's private network address and port information.
  • the encrypted currency detection device is a node containing various popular encrypted currencies. What needs to be modified is to actively connect to the designated address port.
  • the P2P network of Bitcoin is based on TCP, and the default communication port of the main network is 8333;
  • Ethereum provides two connection methods, UDP and TCP.
  • the main network defaults to TCP port 30303, and the recommended UDP discovery port is 30301. If the handshake with the specified node is successful, it proves that the peer host is running the encrypted currency program; if it is a passive monitoring method, it is equivalent to a node that integrates the functions of mainstream encrypted currency nodes, accesses the network, and receives ledger broadcast messages.
  • the encrypted currency detection device may include an encrypted currency sniffing device, and other devices for discovering users who have mining behaviors may also be provided, which is not uniquely limited in this embodiment.
  • system architecture platform can be applied to 2G, 3G, 4G, 5G communication network systems and subsequent evolved mobile communication network systems, etc., and the system architecture platform can also be used in fixed network communication network systems, This embodiment does not specifically limit it.
  • the network detailed record module is the network detailed record (Internet Protocol Detail Record, IPDR)
  • the user database module is the session management function (Session Management Function, SMF)
  • the currency detection device can obtain the private network address of the specified user through the ability to query the user's private network address provided by SMF; deploy an encrypted currency sniffing device in the encrypted currency detection device to find users who have mining behavior; at the same time, the encrypted currency detection The device can query the user corresponding to the public network address and the private network address by accessing the user's public network address query interface provided by IPDR.
  • the network detailed record module is Internet Protocol Detail Record (IPDR)
  • the user database module is authentication, authorization and accounting (Authentication, Authorization, Accounting , AAA) server
  • the encrypted currency detection device can obtain the private network address and port of the specified user through the ability of querying the user's private network address provided by AAA; the encrypted currency detection device needs to deploy an encrypted currency sniffing device to find out that there is mining behavior users; at the same time, the encrypted currency detection device can access the user's query interface provided by IPDR, and query the user's public network address and private network address corresponding to the public network address.
  • FIG. 1 does not constitute a limitation to the embodiment of the present application, and may include more or less components than those shown in the illustration, or combine some components, or have different Part placement.
  • FIG. 2 is a flow chart of a cryptographic coin mining behavior identification method provided by an embodiment of the present application, and the cryptographic coin mining behavior identification method is applied to a cryptographic coin detection device.
  • the cryptocurrency mining behavior identification method includes but not limited to step S100, step S200, step S300 and step S400.
  • a first private network address is acquired through a preset mode, and the first private network address is a private network address corresponding to a user node suspected of cryptocurrency mining.
  • the cryptocurrency detection device can find a user node suspected of cryptocurrency mining through different preset modes, so as to obtain the first private network address corresponding to the user node.
  • the suspected cryptocurrency mining behavior may include abnormal electricity consumption behavior, and it may also include the behavior of encrypted currency broadcast information in the information sent by the public network address. limited.
  • the preset mode can be the first preset mode, the first preset mode is an active detection mode, and the first preset mode is used to obtain the private network address corresponding to the user node of the abnormal power consumption behavior;
  • the preset The mode can also be the second preset mode, the second preset mode is the passive detection mode, and the second preset mode is used to obtain the private information corresponding to the user node in the public network address of the encrypted coin broadcast information in the sent information. net address.
  • Step S200 sending an encrypted currency detection message to the first private network address.
  • the cryptocurrency detection device after determining the first private network address corresponding to the user node suspected of cryptocurrency mining, the cryptocurrency detection device sends a cryptocurrency detection message to the first private network address.
  • Step S300 acquiring encrypted currency response information sent from the first private network address.
  • the cryptocurrency detection device after the cryptocurrency detection device sends the cryptocurrency detection message to the first private network address, the cryptocurrency detection device receives back the cryptocurrency response information sent from some of the first private network addresses.
  • Step S400 Determine the second private network address from the first private network address according to the cryptocurrency response information, and the second private network address is a private network address where cryptocurrency mining behavior exists.
  • the encrypted currency detection device can determine the second private network address from the first private network address according to the encrypted currency response information, and the second private network address is a private network address with encrypted currency mining behavior.
  • the detection device can obtain the first private network address with suspected cryptocurrency behavior through the core network, and then send a cryptocurrency detection message to the first private network address to confirm the second private network address with cryptocurrency behavior. Therefore, it can solve The problem that specific users cannot be accurately located through public network address information can effectively improve the accuracy of cryptocurrency mining behavior identification.
  • the encrypted currency detection device obtains the first private network address through a preset mode, and the first private network address is a private network address corresponding to a user node suspected of having encrypted currency mining behavior; to the first private network address Send an encrypted currency detection message; obtain the encrypted currency response information sent from the first private network address; determine the second private network address from the first private network address according to the encrypted currency response information, and the second private network address is the existence of encrypted currency mining The private network address of the mining behavior.
  • the encrypted currency detection device can obtain the first private network address with suspected encrypted currency behavior through the core network, and then send an encrypted currency detection message for the first private network address to confirm the existence of encrypted currency behavior Therefore, it can solve the problem that the specific user cannot be accurately located through the public network address information, thereby effectively improving the accuracy of the identification of cryptocurrency mining behavior.
  • step S100 when the preset mode is the first preset mode, includes but not limited to the following steps S310 , S320 and S330 .
  • Step S310 acquire the address information of the abnormal power consumption user information through the first preset mode
  • Step S320 acquiring the subscriber information corresponding to the address information from the user database module according to the address information
  • Step S330 determining the first private network address according to the subscriber information.
  • the encrypted currency detection device can obtain the address information of the abnormal power consumption user information from the power operator through the first preset mode, and actively obtain the contract user information corresponding to the address information from the user database module according to the address information, Then determine the first private network address according to the subscriber information. That is, the encrypted currency detection device can obtain the first private network address corresponding to the abnormal power consumption user information through the first preset mode, and can actively detect user nodes suspected of having encrypted currency mining behavior.
  • the power operator when the power operator finds an abnormal power user, it provides the address information of the abnormal user to the telecom operator, and the encrypted currency detection device obtains the address information, and then obtains the corresponding address information from AAA based on the address information.
  • the subscriber information of the subscriber and then determine the first private network address according to the subscriber information. That is, the encrypted currency detection device can obtain the first private network address corresponding to the abnormal power consumption user information through the first preset mode, and can actively detect user nodes suspected of having encrypted currency mining behavior.
  • an industry application device is newly deployed in the core network of the fixed network
  • an encrypted currency detection device is deployed in the industry application device, wherein the encrypted currency detection device may include a simplified version of multiple encrypted currencies.
  • Mining protocol such as only keeping monitoring, querying nodes, establishing links and other P2P functions.
  • the first preset mode of this embodiment has the advantages of real-time detection capability, short detection time, and high efficiency.
  • the first preset mode does not need to introduce IPDR, can effectively protect user privacy, and does not need to deploy deep packet
  • the detection technology (Deep Packet Inspection, DPI) analyzes the user's online code stream, and the deployment cost is low.
  • step S330 includes but not limited to the following steps S410 , S420 and S430 .
  • Step S410 determining the user number information from the subscriber information
  • Step S420 obtaining access information corresponding to the user number information according to the user number information
  • Step S430 determine the first private network address according to the access information.
  • AAA provides an external interface query capability, which can obtain the user's user access information through user number information query, including the assigned private network address, etc.
  • the encryption currency detection device has the ability to access the AAA open interface ability, and obtain the user's private network address and port information through this interface, the encrypted currency detection device determines the user number information from the subscriber information, and then obtains the access information corresponding to the user number information from AAA according to the user number information, and then Determine the first private network address according to the access information.
  • step S400 includes but not limited to the following step S510 .
  • Step S510 determine target user information from the abnormal power consumption user information according to the second private network address, and the target user information represents a user who has cryptocurrency mining behavior.
  • the encrypted coin detection device can determine the target user information from the abnormal power consumption user information according to the second private network address, because the second private network address is the encrypted currency detection device It can be confirmed by checking the encrypted currency detection message sent by the first private network address, so it can accurately determine the user node where the encrypted currency mining behavior actually occurs, and improve the efficiency of cracking down on mining behavior.
  • the default mode is the second default mode for obtaining the private network address corresponding to the user node in the public network address of the encrypted currency broadcast information included in the sent information
  • step S100 includes but not limited to the following steps S610, S620 and S630.
  • Step S610 acquire encrypted currency broadcast information through the second preset mode
  • Step S620 determine the public network address corresponding to the encrypted currency broadcast information according to the encrypted currency broadcast information
  • Step S630 determining a first private network address corresponding to the public network address according to the public network address.
  • the encrypted currency detection device can obtain all encrypted currency broadcast information in the core network through the second preset mode, and then determine the public network address corresponding to the encrypted currency broadcast information according to the encrypted currency broadcast information, and then according to the public network The address determines one or more first private network addresses corresponding to the public network address. That is to say, the encrypted currency detection device can obtain the first private network address corresponding to the user node in the public network address of the transmitted information including encrypted currency broadcast information through the second preset mode. Passive detection of user nodes does not need to provide suspicious user nodes, and all mining nodes can be found.
  • an encrypted currency detection device is deployed in the core network, and the encrypted currency detection device is activated during work, and all popular encrypted currency broadcast information in the core network is received by the encrypted currency detection device, and the corresponding message of the encrypted currency broadcast information is recorded
  • IPDR network detailed record module
  • the step of obtaining broadcast information of encrypted coins through the second preset mode can be to determine the area range to be detected from the core network through the second preset mode, and then obtain all encrypted currency broadcast information within the area range for the area range Information does not receive information from other areas outside the scope of the area; or it can also acquire all encrypted currency broadcast information in the core network, which is not specifically limited in this embodiment.
  • steps after step S400 include but are not limited to the following steps S710 and S720 .
  • Step S710 obtaining user number information corresponding to the second private network address from the user database module according to the second private network address;
  • Step S720 generating a list of users with mining behavior according to the user number information.
  • the encrypted currency detection device can obtain the user number information corresponding to the second private network address from the user database module according to the second private network address, and then generate There is a list of users with mining behavior. Since the second private network address is confirmed by the encrypted currency detection device by checking the first private network address and sending encrypted currency detection messages, the user information obtained through the second private network address can be accurate. Determine the user nodes where the cryptocurrency mining behavior actually occurs, thereby improving the efficiency of cracking down on mining behavior.
  • an embodiment of the present application also provides an encryption coin mining behavior identification device, the encryption coin mining behavior identification device includes:
  • the first obtaining module is used to obtain a first private network address through a preset mode, and the first private network address is a private network address corresponding to a user node suspected of cryptocurrency mining;
  • a sending module configured to send an encrypted currency detection message to the first private network address
  • the second obtaining module is used to obtain the encrypted currency response information sent from the first private network address
  • a determining module configured to determine a second private network address from the first private network address according to the encrypted currency response information, and the second private network address is a private network address where cryptocurrency mining behavior exists.
  • the first acquiring module is further configured to, when the preset mode is the first preset mode for acquiring the private network address corresponding to the user node of the abnormal power consumption behavior, through the first preset mode Obtain the address information of the abnormal power consumption user information; acquire the subscriber information corresponding to the address information from the user database module according to the address information; determine the first private network address according to the subscriber information.
  • the first acquiring module is further configured to determine the subscriber number information from the subscriber information; obtain the access information corresponding to the subscriber number information according to the subscriber number information; determine the second subscriber number information according to the access information A private network address.
  • the determination module is further configured to determine target user information from the abnormal power consumption user information according to the second private network address, and the target user information represents a user who has cryptocurrency mining behavior.
  • the first obtaining module is also used to obtain the private network address corresponding to the user node in the public network address of the public network address that includes encrypted coin broadcast information in the sent information when the preset mode is
  • the second preset mode is to obtain encrypted currency broadcast information through the second preset mode; determine the public network address corresponding to the encrypted currency broadcast information according to the encrypted currency broadcast information; determine the public network address corresponding to the public network address according to the public network address The first private network address corresponding to the network address.
  • the first obtaining module is further configured to query all first private network addresses corresponding to the public network address from the network detailed record module according to the public network address.
  • the determining module is further configured to acquire user number information corresponding to the second private network address from the user database module according to the second private network address; User list for mining activities.
  • the first acquisition module is further configured to determine the area range to be detected from the core network through the second preset mode; and acquire all encrypted currency broadcast information within the area range.
  • an embodiment of the present application also provides a device for detecting encrypted coins, the device for detecting encrypted coins includes: a memory, a processor, and a computer program stored on the memory and operable on the processor.
  • the processor and memory can be connected by a bus or other means.
  • memory can be used to store non-transitory software programs and non-transitory computer-executable programs.
  • the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage devices.
  • the memory includes, in some embodiments, memory located remotely from the processor, which remote memories may be connected to the processor via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the encrypted currency detection device in this embodiment can be applied as the encrypted currency detection device 110 in the embodiment shown in Figure 1, and the encrypted currency detection device in this embodiment can be configured, for example, as shown in Figure 1
  • These embodiments all belong to the same inventive concept, so these embodiments have the same implementation principle and technical effect, and will not be described in detail here.
  • the non-transitory software programs and instructions required to realize the encryption coin mining behavior identification method of the above embodiment are stored in the memory, and when executed by the processor, the encryption coin mining activity identification method in the above embodiment is executed, for example, Perform method steps S100 to S400 in FIG. 2 described above, method steps S310 to S330 in FIG. 3 , method steps S410 to S430 in FIG. 4 , method steps S510 in FIG. 5 , method steps S610 to S610 in FIG. 6 S630, method steps S710 to S720 in FIG. 7 .
  • an embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by a processor or a controller, for example, by the above-mentioned Execution by a processor in the embodiment of the communication device can cause the above-mentioned processor to execute the encryption coin mining behavior identification method in the above-mentioned embodiment, for example, execute the method steps S100 to S400 in FIG. 2 described above, and the steps in FIG. 3 Method steps S310 to S330, method steps S410 to S430 in FIG. 4 , method steps S510 in FIG. 5 , method steps S610 to S630 in FIG. 6 , method steps S710 to S720 in FIG. 7 .
  • the encrypted currency mining behavior identification method of the embodiment of the present application is applied to the encrypted currency detection device.
  • the encrypted currency detection device is set in the core network.
  • the encrypted currency detection device obtains the first private network address through the preset mode.
  • the first private network address is The private network address corresponding to the user node suspected of cryptocurrency mining behavior; send a cryptocurrency detection message to the first private network address; obtain the cryptocurrency response information sent from the first private network address; according to the cryptocurrency response information from
  • the second private network address is determined in the first private network address, and the second private network address is a private network address where cryptocurrency mining behavior exists.
  • the encrypted currency detection device can obtain the first private network address with suspected encrypted currency behavior through the core network, and then send an encrypted currency detection message for the first private network address to confirm the existence of encrypted currency behavior Therefore, it can solve the problem that the specific user cannot be accurately located through the public network address information, thereby effectively improving the accuracy of the identification of cryptocurrency mining behavior.
  • Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic storage devices, or can Any other medium used to store desired information and which can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • Finance (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请公开了一种加密币挖矿行为识别方法、加密币探测装置及存储介质。该加密币挖矿行为识别方法包括：通过预设模式获取疑似存在加密币挖矿行为的第一私网地址(S100)；向第一私网地址发送加密币探测报文(S200)；获取来自第一私网地址发送的加密币回应信息(S300)，以从第一私网地址中确定第二私网地址，第二私网地址为存在加密币挖矿行为的私网地址(S400)。

Description

加密币挖矿行为识别方法、加密币探测装置及存储介质
相关申请的交叉引用
本申请基于申请号为202111290067.X、申请日为2021年11月02日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及通信技术领域，尤其是一种加密币挖矿行为识别方法、加密币探测装置及存储介质。
背景技术
随着社会的发展，对电力的需求也如日剧增，电力短缺问题经常困扰着各个国家。但近几年随着加密币的兴起，此类严重消耗电力资源的业务加重电力资源缺口，另外也对电网安全造成严重挑战。近期提出碳中和计划：“将提高国家自主贡献力度，采取更加有力的政策和措施，二氧化碳排放力争于2030年前达到峰值，努力争取2060年前实现碳中和”。所以，打击非法挖矿行为，保护电网安全，达成国家规划目标的工作显得非常重要。而相关方法提出在公网中部署大量比特币探针，通过获取比特币交易信息广播信息推测指定节点的身份信息,但是由于网络地址是有限的，一个公网地址通常会被划分给很多用户，另外现有通信系统分配给用户的公网地址也是不停变化的，那么通过此方法根据公网地址信息无法精确定位到具体的用户。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本申请实施例提供了一种加密币挖矿行为识别方法、加密币探测装置及存储介质。
第一方面，本申请实施例提供了一种加密币挖矿行为识别方法，应用于加密币探测装置，所述加密币探测装置设置在核心网，所述方法包括：通过预设模式获取第一私网地址，所述第一私网地址为疑似存在加密币挖矿行为的用户节点所对应的私网地址；向所述第一私网地址发送加密币探测报文；获取来自所述第一私网地址发送的加密币回应信息；根据所述加密币回应信息确定从所述第一私网地址中确定第二私网地址，所述第二私网地址为存在加密币挖矿行为的私网地址。
第二方面，本申请实施例还提供了一种加密币探测装置，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如上第一方面所述的加密币挖矿行为识别方法。
第三方面，本申请实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，计算机可执行指令用于执行如上第一方面所述的加密币挖矿行为识别方法。
本申请的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本申请而了解。本申请的目的和其他优点可通过在说明书、权利要求书 以及附图中所特别指出的结构来实现和获得。
附图说明
附图用来提供对本申请技术方案的进一步理解，并且构成说明书的一部分，与本申请的实施例一起用于解释本申请的技术方案，并不构成对本申请技术方案的限制。
图1是本申请一个实施例提供的用于执行加密币挖矿行为识别方法的系统架构的示意图；
图2是本申请一个实施例提供的加密币挖矿行为识别方法的流程图；
图3是本申请一个实施例提供的加密币挖矿行为识别方法中通过第一预设模块确定第一私网地址的流程图；
图4是本申请一个实施例提供的加密币挖矿行为识别方法中进一步限定确定第一私网地址的流程图；
图5是本申请一个实施例提供的加密币挖矿行为识别方法中确定目标挖矿行为用户的流程图；
图6是本申请一个实施例提供的加密币挖矿行为识别方法中通过第二预设模块确定第一私网地址的流程图；
图7是本申请一个实施例提供的加密币挖矿行为识别方法中生成挖矿行为用户列表的流程图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的实施例仅用以解释本申请，并不用于限定本申请。
需要说明的是，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于流程图中的顺序执行所示出或描述的步骤。说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
本申请提供了一种加密币挖矿行为识别方法、加密币探测装置及存储介质，其中，加密币挖矿行为识别方法包括：通过预设模式获取第一私网地址，第一私网地址为疑似存在加密币挖矿行为的用户节点所对应的私网地址；向第一私网地址发送加密币探测报文；获取来自第一私网地址发送的加密币回应信息；根据加密币回应信息从第一私网地址中确定第二私网地址，第二私网地址为存在加密币挖矿行为的私网地址。本实施例的技术方案中，由于加密币探测装置可以通过核心网得到存在加密币疑似行为的第一私网地址，然后再针对第一私网地址发送加密币探测报文以确认存在加密币行为的第二私网地址，因此，能够解决通过公网地址信息无法精确定位到具体用户的问题，从而能够有效提高对加密币挖矿行为识别的准确率。
下面结合附图，对本申请实施例作进一步阐述。
如图1所示，图1是本申请一个实施例提供的用于执行的加密币挖矿行为识别方法的系统架构平台的示意图。
在图1的示例中，该系统架构平台设置在核心网中，核心网包括加密币探测装置110、 与加密币探测装置连接的网络详细记录模块120和与加密币探测装置连接用户数据库模块130，其中，网络详细记录模块用于提供的用户的查询接口，并用于查询公网地址对应的用户的公网地址和私网地址，用户数据库模块用于查询用户私网地址能力，还用于获取到指定用户的私网地址和端口信息。
需要说明的是，加密币探测装置是一个包含各个流行加密币的一个节点，需要改造的是对于主动连接指定地址端口，例如比特币的P2P网络基于TCP构建，主网默认通信端口是8333；又例如，以太坊提供UDP和TCP两种连接方式，主网默认TCP端口30303，推荐UDP发现端口为30301。如果与指定节点握手成功，即证明对端主机运行着加密币程序；如果为被动监听方式，就相当于集成了主流加密币节点功能的一个节点，接入网络，接收账本广播消息。
需要说明的是，加密币探测装置可以包括加密币嗅探装置，还可以设置其他用于发现存在挖矿行为的用户的装置，本实施例对其不作唯一限定。
本领域技术人员可以理解的是，该系统架构平台可以应用于2G、3G、4G、5G通信网络系统以及后续演进的移动通信网络系统等，该系统架构平台也可以用于固网通信网络系统，本实施例对此并不作具体限定。
需要说明的是，系统架构平台应用于5G移动通信网络系统时，网络详细记录模块为网络详细记录(Internet Protocol Detail Record，IPDR)，用户数据库模块为会话管理功能(Session Management Function,SMF)，加密币探测装置能够通过SMF提供的查询用户私网地址的能力获取到指定用户的私网地址；在加密币探测装置中部署加密币嗅探装置用于发现存在挖矿行为的用户；同时加密币探测装置能够通过访问IPDR提供的用户的公网地址查询接口，查询公网地址对应的用户以及私网地址。
需要说明的是，系统架构平台应用于固网通信网络系统时，网络详细记录模块为网络详细记录(Internet Protocol Detail Record，IPDR)，用户数据库模块为验证、授权和记账(Authentication、Authorization、Accounting，AAA)服务器，加密币探测装置能通过AAA提供的查询用户私网地址能力获取到指定用户的私网地址和端口；加密币探测装置中需要部署加密币嗅探装置用于发现存在挖矿行为的用户；同时加密币探测装置能访问I PDR提供的用户的查询接口，查询公网地址对应的用户的公网地址和私网地址。
本领域技术人员可以理解的是，图1中示出的系统架构平台并不构成对本申请实施例的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
基于上述系统架构平台，下面提出本申请的加密币挖矿行为识别方法的各个实施例。
如图2所示，图2是本申请一个实施例提供的加密币挖矿行为识别方法的流程图，该加密币挖矿行为识别方法应用于加密币探测装置。该加密币挖矿行为识别方法包括但不限于有步骤S100、步骤S200、步骤S300以及步骤S400。
步骤S100，通过预设模式获取第一私网地址，第一私网地址为疑似存在加密币挖矿行为的用户节点所对应的私网地址。
在一些实施例中，加密币探测装置可以通过不同的预设模式找到疑似存在加密币挖矿行为的用户节点，从而能够获取该用户节点对应的第一私网地址。
需要说明的是，疑似存在加密币挖矿行为可以包括异常用电行为，也可以包括公网地址所发送的信息中包括加密币广播信息的行为，本实施对疑似存在加密币挖矿行为不作具体限定。
需要说明的是，预设模式可以是第一预设模式，第一预设模式为主动探测模式，第一预设模式用于获取异常用电行为的用户节点所对应的私网地址；预设模式也可以是第二预设模式，第二预设模式为被动探测模式，第二预设模式用于获取所发送的信息中包括加密币广播信息的公网地址中的用户节点所对应的私网地址。
步骤S200，向第一私网地址发送加密币探测报文。
在一些实施例中，在确定疑似存在加密币挖矿行为的用户节点对应的第一私网地址之后，加密币探测装置向第一私网地址发送加密币探测报文。
步骤S300，获取来自第一私网地址发送的加密币回应信息。
在一些实施例中，在加密币探测装置向第一私网地址发送加密币探测报文之后，加密币探测装置回接收到来自部分第一私网地址发送的加密币回应信息。
步骤S400，根据加密币回应信息从第一私网地址中确定第二私网地址，第二私网地址为存在加密币挖矿行为的私网地址。
在一些实施例中，加密币探测装置可以根据加密币回应信息从第一私网地址中确定第二私网地址，第二私网地址为存在加密币挖矿行为的私网地址，由于加密币探测装置可以通过核心网得到存在加密币疑似行为的第一私网地址，然后再针对第一私网地址发送加密币探测报文以确认存在加密币行为的第二私网地址，因此，能够解决通过公网地址信息无法精确定位到具体用户的问题，从而能够有效提高对加密币挖矿行为识别的准确率。
在一实施例中，加密币探测装置通过预设模式获取第一私网地址，第一私网地址为疑似存在加密币挖矿行为的用户节点所对应的私网地址；向第一私网地址发送加密币探测报文；获取来自第一私网地址发送的加密币回应信息；根据加密币回应信息从第一私网地址中确定第二私网地址，第二私网地址为存在加密币挖矿行为的私网地址。本实施例的技术方案中，由于加密币探测装置可以通过核心网得到存在加密币疑似行为的第一私网地址，然后再针对第一私网地址发送加密币探测报文以确认存在加密币行为的第二私网地址，因此，能够解决通过公网地址信息无法精确定位到具体用户的问题，从而能够有效提高对加密币挖矿行为识别的准确率。
在一些实施例中，如图3所示，在预设模式为第一预设模式的情况下，步骤S100包括但不限于以下步骤S310、步骤S320和步骤S330。
步骤S310，通过第一预设模式获取异常用电用户信息的地址信息；
步骤S320，根据地址信息从用户数据库模块中获取地址信息对应的签约用户信息；
步骤S330，根据签约用户信息确定第一私网地址。
在一些实施例中，加密币探测装置可以通过第一预设模式从电力运营商中获取异常用电用户信息的地址信息，主动根据地址信息从用户数据库模块中获取地址信息对应的签约用户信息，然后根据签约用户信息确定第一私网地址。即加密币探测装置可以通过第一预设模式获取到异常用电用户信息对应的第一私网地址，能够对疑似存在加密币挖矿行为的用户节点进行主动探测。
在一实施例中，在电力运营商发现异常用电用户的情况下，向电信运营商提供该异常用户的地址信息，加密币探测装置获取该地址信息，然后根据地址信息从AAA获取地址信息对应的签约用户信息，再根据签约用户信息确定第一私网地址。即加密币探测装置可以通过第一预设模式获取到异常用电用户信息对应的第一私网地址，能够对疑似存在加密币挖矿行为 的用户节点进行主动探测。
需要说明的是，在一实施例中固网的核心网中新增部署行业应用装置，在行业应用装置中部署加密币探测装置，其中该加密币探测装置可以包括多种加密货币简化版的挖矿协议，如只保留监听，查询节点，建立链路等P2P功能。
需要说明的是，本实施例的第一预设模式具有实时探测能力，探测时间短、效率高的优点，第一预设模式不需要引入IPDR，能够有效保护用户隐私，而且不需要部署深度包检测技术(Deep Packet Inspection，DPI)对用户上网码流进行解析，部署成本低。
在一实施例中，如图4所示，步骤S330包括但不限于以下步骤S410、步骤S420和步骤S430。
步骤S410，从签约用户信息确定用户号码信息；
步骤S420，根据用户号码信息得到用户号码信息对应的接入信息；
步骤S430，根据接入信息确定第一私网地址。
在一些实施例中，AAA提供一种外部接口查询的能力，具有通过用户号码信息查询得到该用户的用户接入信息，包括分配的私网地址等，加密币探测装置具有用访问AAA开放接口的能力，并通过该接口获取到用户的私网地址和端口信息等，加密币探测装置从签约用户信息确定用户号码信息，然后根据用户号码信息从AAA中得到用户号码信息对应的接入信息，再根据接入信息确定第一私网地址。
在一实施例中，如图5所示，步骤S400之后包括但不限于以下步骤S510。
步骤S510，根据第二私网地址确定从异常用电用户信息中确定目标用户信息，目标用户信息表征存在加密币挖矿行为的用户。
在一些实施例中，当确定第二私网地址之后，加密币探测装置可以根据第二私网地址确定从异常用电用户信息中确定目标用户信息，由于第二私网地址是加密币探测装置可以通过核对第一私网地址发送加密币探测报文所确认的，因此能够精准确定真正发生加密币挖矿行为的用户节点，提高打击挖矿行为的效率。
在一实施例中，如图6所示，在预设模式为用于获取所发送的信息中包括加密币广播信息的公网地址中的用户节点所对应的私网地址的第二预设模式的情况下，步骤S100包括但不限于以下步骤S610、步骤S620和步骤S630。
步骤S610，通过第二预设模式获取加密币广播信息；
步骤S620，根据加密币广播信息确定与加密币广播信息对应的公网地址；
步骤S630，根据公网地址确定与公网地址对应的第一私网地址。
在一些实施例中，加密币探测装置能够通过第二预设模式在核心网中获取所有加密币广播信息，然后根据加密币广播信息确定与加密币广播信息对应的公网地址，再根据公网地址确定与公网地址对应的一个或者多个第一私网地址。即加密币探测装置可以通过第二预设模式获取到所发送的信息中包括加密币广播信息的公网地址中的用户节点所对应的第一私网地址，对疑似存在加密币挖矿行为的用户节点进行被动探测，不需要提供可疑用户节点，可以发现所有挖矿节点。
在一实施例中，在核心网中部署加密币探测装置，工作时启动加密币探测装置，通过加密币探测装置接收核心网中所有流行的加密币广播信息，并记录加密币广播信息对应的消息源的公网地址和端口，加密币探测装置从IPDR(网络详细记录模块)中查询设置在公网地址 下的第一私网地址和端口，即加密币探测装置能够对疑似存在加密币挖矿行为的用户节点进行被动探测。
需要说明的是，通过第二预设模式获取加密币广播信息的步骤，可以是通过第二预设模式从核心网中确定需要探测的区域范围，然后针对区域范围获取区域范围内所有加密币广播信息，不对区域范围外的其他区域的信息进行接收；或者也可以是对核心网中所有加密币广播信息进行获取，本实施例对其不作具体限定。
在一实施例中，如图7所示，步骤S400之后包括但不限于以下步骤S710和步骤S720。
步骤S710，根据第二私网地址从用户数据库模块中获取与第二私网地址对应的用户号码信息；
步骤S720，根据用户号码信息生成存在挖矿行为的用户列表。
在一些实施例中，在确定第二私网地址之后，加密币探测装置可以根据第二私网地址从用户数据库模块中获取与第二私网地址对应的用户号码信息，然后根据用户号码信息生成存在挖矿行为的用户列表，由于第二私网地址是加密币探测装置可以通过核对第一私网地址发送加密币探测报文所确认的，那么通过第二私网地址得到的用户信息能够精准确定真正发生加密币挖矿行为的用户节点，从而提高打击挖矿行为的效率。
另外，本申请的一个实施例还提供了一种加密币挖矿行为识别装置，该加密币挖矿行为识别装置包括：
第一获取模块，用于通过预设模式获取第一私网地址，所述第一私网地址为疑似存在加密币挖矿行为的用户节点所对应的私网地址；
发送模块，用于向所述第一私网地址发送加密币探测报文；
第二获取模块，用于获取来自所述第一私网地址发送的加密币回应信息；
确定模块，用于根据所述加密币回应信息从所述第一私网地址中确定第二私网地址，所述第二私网地址为存在加密币挖矿行为的私网地址。
在一实施例中，第一获取模块还用于当所述预设模式为用于获取异常用电行为的用户节点所对应的私网地址的第一预设模式，通过所述第一预设模式获取异常用电用户信息的地址信息；根据地址信息从所述用户数据库模块中获取所述地址信息对应的签约用户信息；根据所述签约用户信息确定第一私网地址。
在一实施例中，第一获取模块还用于从所述签约用户信息确定用户号码信息；根据所述用户号码信息得到所述用户号码信息对应的接入信息；根据所述接入信息确定第一私网地址。
在一实施例中，确定模块还用于根据所述第二私网地址确定从所述异常用电用户信息中确定目标用户信息，所述目标用户信息表征存在加密币挖矿行为的用户。
在一实施例中，第一获取模块还用于当所述预设模式为用于获取所发送的信息中包括加密币广播信息的所述公网地址中的用户节点所对应的私网地址的第二预设模式，通过第二预设模式获取加密币广播信息；根据所述加密币广播信息确定与所述加密币广播信息对应的公网地址；根据所述公网地址确定与所述公网地址对应的第一私网地址。
在一实施例中，第一获取模块还用于根据所述公网地址从所述网络详细记录模块中查询与所述公网地址对应的所有第一私网地址。
在一实施例中，确定模块还用于根据所述第二私网地址从所述用户数据库模块中获取与所述第二私网地址对应的用户号码信息；根据所述用户号码信息生成存在挖矿行为的用户列 表。
在一实施例中，第一获取模块还用于通过第二预设模式从所述核心网中确定需要探测的区域范围；获取所述区域范围内所有加密币广播信息。
需要说明的是，上述加密币挖矿行为识别装置与加密币挖矿行为识别方法的实施例均属于相同的发明构思，因此这些实施例具有相同的实现原理以及技术效果，此处不再详述。
另外，本申请的一个实施例还提供了一种加密币探测装置，该加密币探测装置包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序。
处理器和存储器可以通过总线或者其他方式连接。
存储器作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序以及非暂态性计算机可执行程序。此外，存储器可以包括高速随机存取存储器，还可以包括非暂态存储器，例如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施方式中，存储器在一些实施例中包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至该处理器。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
需要说明的是，本实施例中的加密币探测装置，可以应用为例如图1所示实施例中的加密币探测装置110，本实施例中的加密币探测装置能够构成例如图1所示实施例中的系统架构的一部分，这些实施例均属于相同的发明构思，因此这些实施例具有相同的实现原理以及技术效果，此处不再详述。
实现上述实施例的加密币挖矿行为识别方法所需的非暂态软件程序以及指令存储在存储器中，当被处理器执行时，执行上述实施例中的加密币挖矿行为识别方法，例如，执行以上描述的图2中的方法步骤S100至S400、图3中的方法步骤S310至S330、图4中的方法步骤S410至S430、图5中的方法步骤S510、图6中的方法步骤S610至S630、图7中的方法步骤S710至S720。
此外，本申请的一个实施例还提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机可执行指令，该计算机可执行指令被一个处理器或控制器执行，例如，被上述通信设备实施例中的一个处理器执行，可使得上述处理器执行上述实施例中的加密币挖矿行为识别方法，例如，执行以上描述的图2中的方法步骤S100至S400、图3中的方法步骤S310至S330、图4中的方法步骤S410至S430、图5中的方法步骤S510、图6中的方法步骤S610至S630、图7中的方法步骤S710至S720。
本申请实施例的加密币挖矿行为识别方法应用于加密币探测装置，该加密币探测装置设置在核心网，加密币探测装置通过预设模式获取第一私网地址，第一私网地址为疑似存在加密币挖矿行为的用户节点所对应的私网地址；向第一私网地址发送加密币探测报文；获取来自第一私网地址发送的加密币回应信息；根据加密币回应信息从第一私网地址中确定第二私网地址，第二私网地址为存在加密币挖矿行为的私网地址。本实施例的技术方案中，由于加密币探测装置可以通过核心网得到存在加密币疑似行为的第一私网地址，然后再针对第一私网地址发送加密币探测报文以确认存在加密币行为的第二私网地址，因此，能够解决通过公网地址信息无法精确定位到具体用户的问题，从而能够有效提高对加密币挖矿行为识别的准确率。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统可以被实 施为软件、固件、硬件及其适当的组合。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
以上是对本申请的一些实施进行了说明，但本申请并不局限于上述实施方式，熟悉本领域的技术人员在不违背本申请精神的前提下还可作出种种的等同变形或替换，这些等同的变形或替换均包含在本申请权利要求所限定的范围内。

Claims (11)

  1. 一种加密币挖矿行为识别方法，应用于加密币探测装置，所述加密币探测装置设置在核心网，所述方法包括：
    通过预设模式获取第一私网地址，所述第一私网地址为疑似存在加密币挖矿行为的用户节点所对应的私网地址；
    向所述第一私网地址发送加密币探测报文；
    获取来自所述第一私网地址发送的加密币回应信息；
    根据所述加密币回应信息从所述第一私网地址中确定第二私网地址，所述第二私网地址为存在加密币挖矿行为的私网地址。
  2. 根据权利要求1所述的加密币挖矿行为识别方法，其中，所述疑似存在加密币挖矿行为包括以下至少之一：
    异常用电行为；或
    公网地址所发送的信息中包括加密币广播信息的行为。
  3. 根据权利要求2所述的加密币挖矿行为识别方法，其中，所述核心网包括用户数据库模块，当所述预设模式为用于获取异常用电行为的用户节点所对应的私网地址的第一预设模式，所述通过预设模式获取第一私网地址包括：
    通过所述第一预设模式获取异常用电用户信息的地址信息；
    根据地址信息从所述用户数据库模块中获取所述地址信息对应的签约用户信息；
    根据所述签约用户信息确定第一私网地址。
  4. 根据权利要求3所述的加密币挖矿行为识别方法，其中，所述根据所述签约用户信息确定第一私网地址，包括：
    从所述签约用户信息确定用户号码信息；
    根据所述用户号码信息得到所述用户号码信息对应的接入信息；
    根据所述接入信息确定第一私网地址。
  5. 根据权利要求3所述的加密币挖矿行为识别方法，其中，所述根据所述加密币回应信息确定从所述第一私网地址中确定第二私网地址之后，所述方法还包括：
    根据所述第二私网地址确定从所述异常用电用户信息中确定目标用户信息，所述目标用户信息表征存在加密币挖矿行为的用户。
  6. 根据权利要求2所述的加密币挖矿行为识别方法，其中，当所述预设模式为用于获取所发送的信息中包括加密币广播信息的所述公网地址中的用户节点所对应的私网地址的第二预设模式，所述通过预设模式获取第一私网地址包括：
    通过第二预设模式获取加密币广播信息；
    根据所述加密币广播信息确定与所述加密币广播信息对应的公网地址；
    根据所述公网地址确定与所述公网地址对应的第一私网地址。
  7. 根据权利要求6所述的加密币挖矿行为识别方法，其中，所述核心网包括网络详细记录模块，所述根据所述公网地址确定与所述公网地址对应的第一私网地址，包括：
    根据所述公网地址从所述网络详细记录模块中查询与所述公网地址对应的所有第一私网地址。
  8. 根据权利要求7所述的加密币挖矿行为识别方法，其中，所述核心网包括用户数据库模块，在所述根据所述加密币回应信息确定从所述第一私网地址中确定第二私网地址之后，所述方法还包括：
    根据所述第二私网地址从所述用户数据库模块中获取与所述第二私网地址对应的用户号码信息；
    根据所述用户号码信息生成存在挖矿行为的用户列表。
  9. 根据权利要求6所述的加密币挖矿行为识别方法，其中，所述通过第二预设模式获取加密币广播信息，包括：
    通过第二预设模式从所述核心网中确定需要探测的区域范围；
    获取所述区域范围内所有加密币广播信息。
  10. 一种加密币探测装置，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如权利要求1至9任意一项所述的加密币挖矿行为识别方法。
  11. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1至9任意一项所述的加密币挖矿行为识别方法。
PCT/CN2022/121416 2021-11-02 2022-09-26 加密币挖矿行为识别方法、加密币探测装置及存储介质 WO2023077993A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111290067.X 2021-11-02
CN202111290067.XA CN116071057A (zh) 2021-11-02 2021-11-02 加密币挖矿行为识别方法、加密币探测装置及存储介质

Publications (1)

Publication Number Publication Date
WO2023077993A1 true WO2023077993A1 (zh) 2023-05-11

Family

ID=86179108

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/121416 WO2023077993A1 (zh) 2021-11-02 2022-09-26 加密币挖矿行为识别方法、加密币探测装置及存储介质

Country Status (2)

Country Link
CN (1) CN116071057A (zh)
WO (1) WO2023077993A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160300222A1 (en) * 2015-04-07 2016-10-13 Modernity Financial Holdings, Ltd. Off network identity tracking in anonymous cryptocurrency exchange networks
CN108563946A (zh) * 2018-04-17 2018-09-21 广州大学 一种浏览器挖矿行为检测的方法、浏览器插件和系统
CN108829829A (zh) * 2018-06-15 2018-11-16 深信服科技股份有限公司 检测虚拟货币挖矿程序的方法、系统、装置及存储介质
CN110839088A (zh) * 2018-08-16 2020-02-25 深信服科技股份有限公司 一种被虚拟货币挖矿的检测方法、系统、装置及存储介质
CN111212039A (zh) * 2019-12-23 2020-05-29 杭州安恒信息技术股份有限公司 基于dns流量的主机挖矿行为检测方法
CN111600850A (zh) * 2020-04-26 2020-08-28 武汉思普崚技术有限公司 一种检测挖矿虚拟货币的方法、设备及存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160300222A1 (en) * 2015-04-07 2016-10-13 Modernity Financial Holdings, Ltd. Off network identity tracking in anonymous cryptocurrency exchange networks
CN108563946A (zh) * 2018-04-17 2018-09-21 广州大学 一种浏览器挖矿行为检测的方法、浏览器插件和系统
CN108829829A (zh) * 2018-06-15 2018-11-16 深信服科技股份有限公司 检测虚拟货币挖矿程序的方法、系统、装置及存储介质
CN110839088A (zh) * 2018-08-16 2020-02-25 深信服科技股份有限公司 一种被虚拟货币挖矿的检测方法、系统、装置及存储介质
CN111212039A (zh) * 2019-12-23 2020-05-29 杭州安恒信息技术股份有限公司 基于dns流量的主机挖矿行为检测方法
CN111600850A (zh) * 2020-04-26 2020-08-28 武汉思普崚技术有限公司 一种检测挖矿虚拟货币的方法、设备及存储介质

Also Published As

Publication number Publication date
CN116071057A (zh) 2023-05-05

Similar Documents

Publication Publication Date Title
US20210258337A1 (en) Elastic asset-based licensing model for use in a vulnerability management system
CN107800678B (zh) 检测终端异常注册的方法及装置
TWI633775B (zh) 終端識別方法、機器識別碼註冊方法及相應系統、設備
CN114145004B (zh) 用于使用dns消息以选择性地收集计算机取证数据的系统及方法
US9860272B2 (en) System and method for detection of targeted attack based on information from multiple sources
JP2010508598A (ja) ストリング分析を利用する１つまたは複数のパケット・ネットワークでの望まれないトラフィックを検出する方法および装置
US10320688B2 (en) Aggregating flows by endpoint category
TW201405354A (zh) 識別用戶風險的方法和裝置
WO2014000303A1 (zh) 一种报文接收方法、深度包检测设备及系统
US20200213856A1 (en) Method and a device for security monitoring of a wifi network
WO2014024959A1 (ja) トレースセンタ装置、コンテンツをトレース可能にする方法
Fuster et al. Analysis of security and privacy issues in wearables for minors
WO2023077993A1 (zh) 加密币挖矿行为识别方法、加密币探测装置及存储介质
CN112422486B (zh) 一种基于sdk的安全防护方法及设备
CN109587134B (zh) 接口总线的安全认证的方法、装置、设备和介质
CN114697945B (zh) 发现响应消息的生成方法及装置、发现消息的处理方法
CN102231733B (zh) 访问控制方法、主机设备和标识路由器
US20220321605A1 (en) Verifying trust postures of heterogeneous confidential computing clusters
CN111611574A (zh) 信息获取方法、装置、设备和系统
CN115643573A (zh) 一种基于动态安全环境的特权账号认证方法及系统
US10237080B2 (en) Tracking data usage in a secure session
CN110995717B (zh) 报文处理方法、装置、电子设备及漏洞扫描系统
CN101860435B (zh) 报文发送、接收以及确定网络节点的方法及装置
CN109246678A (zh) 一种无线通信方法与智能终端
US10263798B2 (en) Validating hypertext transfer protocol messages for a toll-free data service

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22889019

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE