CMShark: A NetFlow and machine-learning based crypto-jacking intrusion-detection method

Abstract

Crypto-jacking attack is a novel type of cyber-attack on the internet that has emerged because of the popularity of digital currencies. These attacks are the most common type of attacks in the cryptocurrency field because of their specific features such as easy scenario, un-traceability, and ease of secrecy. In crypto-jacking attacks, it is common to embed malicious code inside website scripts. Different techniques have been provided to deal with Crypto-jacking attacks, but crypto-jacking attackers bypass them by limiting resources. The crypto-mining services provided on the internet are legal, and due to the anonymous nature of cryptocurrencies, client identification is a challenging task. Improving the accuracy and performance of the Crypto-jacking attack detection methods are the main objectives of this study. In this paper, a hybrid network-based method to identify these attacks to achieve better and more accurate results. The proposed solution (CMShark) is a combination of machine learning (ML) models, IP blacklisting and payload inspection methods. In the ML model, the packets are classified using size patterns; in IP blacklisting, attacks are detected based on known infected addresses and infected scripts. In payload inspection, the provided information on the packet payload is searched for any suspicious keywords. The proposed method relies solely on the network and is deployed on the edge of the network, making it infrastructureindependent. The proposed detection model reaches an accuracy score of 97.02%, an F1-score of 96.90% a ROC AUC score of 97.20% in input NetFlow classification; and a 93.98% accuracy score, 94.30% F1-score and 97.30% ROC AUC score in output NetFlow classification.