Cryptojacking Malware Hunting: A Method Based on Ensemble Learning of Hierarchical Threat Intelligence Feature

ZHENG Rui; WANG Qiu-yun; LIN Zhuo-pang; JING Rong-qi; JIANG Zheng-wei; FU Jian-ming; WANG Shu-wei

doi:10.12263/DZXB.20211333

您当前的位置：

首页 >

文章列表页 >

Cryptojacking Malware Hunting: A Method Based on Ensemble Learning of Hierarchical Threat Intelligence Feature

PAPERS | 更新时间：2025-12-08

- Cryptojacking Malware Hunting: A Method Based on Ensemble Learning of Hierarchical Threat Intelligence Feature
- ACTA ELECTRONICA SINICA Vol. 50, Issue 11, Pages: 2707-2715(2022)
- 作者机构：
  
  1.武汉大学国家网络安全学院空天信息安全与可信计算教育部重点实验室,湖北武汉 430072
  2.中国科学院信息工程研究所,北京 100093
  3.中国科学院大学网络空间安全学院,北京 100049
- 作者简介：
- 基金信息：
- DOI：10.12263/DZXB.20211333
  CLC： TP309.5
- Received：29 September 2021，
  
  Revised：2022-01-17，
  
  Published：25 November 2022
- 稿件说明：
移动端阅览
郑锐,汪秋云,林卓庞等.一种基于威胁情报层次特征集成的挖矿恶意软件检测方法[J].电子学报,2022,50(11):2707-2715.

ZHENG Rui,WANG Qiu-yun,LIN Zhuo-pang,et al.Cryptojacking Malware Hunting: A Method Based on Ensemble Learning of Hierarchical Threat Intelligence Feature[J].ACTA ELECTRONICA SINICA,2022,50(11):2707-2715.
郑锐,汪秋云,林卓庞等.一种基于威胁情报层次特征集成的挖矿恶意软件检测方法[J].电子学报,2022,50(11):2707-2715. DOI： 10.12263/DZXB.20211333.

ZHENG Rui,WANG Qiu-yun,LIN Zhuo-pang,et al.Cryptojacking Malware Hunting: A Method Based on Ensemble Learning of Hierarchical Threat Intelligence Feature[J].ACTA ELECTRONICA SINICA,2022,50(11):2707-2715. DOI： 10.12263/DZXB.20211333.

摘要

挖矿恶意软件是近年来出现的一种新型恶意软件，其加密运算模式给受害用户带来巨大损失.通过研究挖矿恶意软件的静态特征，本文提出一种基于威胁情报层次特征集成的挖矿恶意软件检测方法.从挖矿恶意软件威胁情报的角度，本文分别使用字节特征层、PE（Portable Executable）结构特征层和挖矿操作执行特征层训练挖矿恶意软件分类器，利用不同恶意软件特征对恶意软件的检测偏好，使用集成方法在层次特征的基础上组建挖矿恶意软件检测器.在实验评估中，本文使用模拟实验室环境数据集和模拟真实世界数据集进行模型性能测试.实验结果表明，本文所设计的层次特征集成的挖矿恶意软件检测方法在模拟真实世界数据集上取得了97.01%的准确率，相对挖矿恶意软件检测基线方法获取了6.13%的准确率提升.

Abstract

Cryptojacking malware is a new type of malware that has emerged in recent years and poses a significant threat to user host security. By studying static features of cryptojacking malware

a detection method is proposed based on integrating hierarchical threat intelligence features. We train cryptojacking malware detectors using the raw byte feature

PE(Portable Executable) parsing feature

and cryptocurrency mining operation feature

respectively. Then

the ensemble learning is used for combining these detectors to form a cryptojacking malware detector from the perspective of hierarchical threat intelligence. In the experiments

the simulated lab dataset and the simulated real-world dataset are used for performance evaluation. The experimental results show that the proposed method acquires 97.01% accuracy rate

which gets improvements of 6.13% relative to the baseline method.

关键词

Keywords

references

TEKINER E , ACAR A , ULUAGAC A S , et al . Sok: cryptojacking malware [C]// 2021 IEEE European Symposium on Security and Privacy(EuroS&P) . Vienna : IEEE , 2021 : 120 - 139 .

PASTRANA S , SUAREZ-TANGIL G . A first look at the crypto-mining malware ecosystem: A decade of unrestricted wealth [C]// Proceedings of the Internet Measurement Conference(IMC) . Amsterdam : ACM , 2019 : 73 - 86 .

安天 . 六小时处置挖矿蠕虫的内网大规模感染事件 [EB/OL]. ( 2019-09-25 )[ 2021-09-15 ]. https: //antiy.cn/research/ https://antiy.cn/research/

no tice&report/research_report/ 20190925 . html .

YAZDINEJAD A , HADDADPAJOUH H , DEHGHANTANHA A , et al . Cryptocurrency malware hunting: A deep recurrent neural network approach [J]. Applied Soft Computing , 2020 , 96 : 106630 .

NASEEM F , ARIS A , BABUN L , et al . MINOS: a lightweight real-time cryptojacking detection system [C]// Proceedings of the 28th Network and Distributed System Security Symposium . Virtual : The Internet Society , 2021 : 21 - 25 .

KONOTH R K , WEGBERG R VAN , MOONSAMY V , et al . Malicious cryptocurrency miners: Status and outlook [EB/OL]. ( 2019-01-29 )[ 2021-09-15 ]. https://arxiv.org/pdf/1901.10794 https://arxiv.org/pdf/1901.10794 .

KOLTER J Z , MALOOF M A . Learning to detect and classify malicious executables in the wild [J]. Journal of Machine Learning Research , 2006 , 7 ( 12 ): 2721 - 2744 .

NATARAJ L , KARTHIKEYAN S , JACOB G , et al . Malware images: visualization and automatic classification [C]// Proceedings of the 8th International Symposium on Visualization for Cyber Security . Pittsburgh : ACM , 2011 : 1 - 7 .

KIM J Y , BU S J , CHO S B . Zero-day malware detection using transferred generative adversarial networks based on deep autoencoders [J]. Information Sciences , 2018 , 460 : 83 - 102 .

SAXE J , BERLIN K . Deep neural network based malware detection using two dimensional binary program features [C]// 2015 10th International Conference on Malicious and Unwanted Software(MALWARE) . Fajardo : IEEE , 2015 : 11 - 20 .

RAFF E , BARKER J , SYLVESTER J , et al . Malware detection by eating a whole exe [C]// Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence . New Orleans : AAAI Press , 2018 : 268 - 276 .

RAFF E , FLESHMAN W , ZAK R , et al . Classifying sequences of extreme length with constant memory applied to malware detection [C]// Proceedings of the AAAI Conference on Artificial Intelligence . Menlo Park : AAAI Press , 2021 : 9386 - 9394 .

SCHULTZ M G , ESKIN E , ZADOK F , et al . Data mining methods for detection of new malicious executables [C]// Proceedings 2001 IEEE Symposium on Security and Privacy(S&P) . Oakland : IEEE , 2000 : 38 - 49 .

SHAFIQ M Z , TABISH S M , MIRZA F , et al . Pe-miner: mining structural information to detect malicious executables in realtime [C]// Recent Advances in Intrusion Detection 12th International Symposium(RAID) . Saint-Malo : Springer , 2009 : 121 - 141 .

ANDERSON H S , ROTH P . Ember: an open dataset for training static pe malware machine learning models [EB/OL]. ( 2018-04-16 )[ 2021-09-15 ]. https://arxiv.org/pdf/1804. 04637 https://arxiv.org/pdf/1804.04637 .

Microsoft Threat Intelligence Center . Threat actor leverages coin miner techniques to stay under the radar-here's how to spot them [EB/OL]. ( 2020-11-30 )[ 2021-09-20 ]. https://www.microsoft.com/security/blog/2020/11/30/t https://www.microsoft.com/security/blog/2020/11/30/t .

CHAN K H R , YU Y , YOU C , et al . ReduNet: a white-box deep network from the principle of maximizing rate reduction [EB/OL]. ( 2021-11-29 )[ 2021-09-15 ]. https://arxiv.org/pdf/2105.10446 https://arxiv.org/pdf/2105.10446 .

BELLE V VAN , CALSTER B VAN , HUFFEL S VAN , et al . Explaining support vector machines: a color based nomogram [J]. PloS ONE , 2016 , 11 ( 10 ): e0164568 .

KIRASICH K , SMITH T , SADLER B . Random forest vs logistic regression: binary classification for heterogeneous datasets [J]. SMU Data Science Review , 2018 , 1 ( 3 ): 9 .

AGHAKHANI H , GRITTI F , MECCA F , et al . When malware is packin'heat; limits of machine learning classifiers based on static analysis features [C]// 27th Annual Network and Distributed System Security Symposium . San Diego : The Internet Society , 2020 .

JORDANEY R , SHARAD K , DASH S K , et al . Transcend: detecting concept drift in malware classification models [C]// Proceedings of the 26th USENIX Security Symposium . Vancouver : USENIX Association , 2017 : 625 - 642 .

DEMETRIO L , BIGGIO B , LAGORIO G , et al . Functionality-preserving black-box optimization of adversarial windows malware [J]. IEEE Transactions on Information Forensics and Security , 2021 , 16 : 3469 - 3478 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

DRHA-UIE: An Underwater Image Enhancement Method Based on Dual Residual Hybrid Attention Block

Automatic Classification of Non-Functional Requirements in App User Reviews Based on System Model

A Deep Learning Track Correlation Method

Ensemble Learning-Based Relay Selection Scheme in Full-Duplex Relay System for Secure Transmission

Related Author

WANG Xin

SHI Hui

LI Xue-ying

WANG Tian-lu

LIANG Peng

WANG Chong

CUI Ya-qi

HE You

Related Institution

College of Computer Science and Technology， Jilin University

School of Computer Science, Wuhan University

Institute of Information Fusion, Naval Aeronautical University

School of Communication and Information Engineering, Chongqing University of Posts and Telecommunications

School of Computer Science， Wuhan University

⁰