Real-Time Symbolic Reasoning Framework for Cryptojacking Detection Based on Netflow-Plus Analysis

Cryptojacking is a cybersecurity threat in which cybercriminals use unauthorized computing resources for cryptocurrency mining. This kind of illegal activity is showing an intensifying trend when cryptocurrency becomes widely acceptable. However, the machine learning (ML) based detection approaches cannot be applied in real-time yet due to low performance. First, compared with domain experts the ML researchers have a tendency to extend feature set with statistical functions, which are very computational heavy. Second, in network security research analyzed metadata are hardly collected if the targeted traffic is a kind of mice-flow (1–2% of total traffic). Netflow is a sampling technique and statistically it cannot be applied in such a case. Third, the ML community usually ignores data preprocessing costs which may take more time than the inference itself. These three types of fundamental weakness prevent the ML based detection algorithms from being applied to a large network in real-time. We propose a novel symbolic reasoning framework to accurately detect such illegal cryptojacking in real-time. To deal with mice-flows, Netflow-plus traffic analyzing technique is proposed to compute TCP metadata using a parallel protocol parser in which every TCP flow is analyzed but the TCP payload. High performance is maintained by only addition based aggregation is allowed. Feature set selection is done by domain experts without using any STD and VAR statistic functions. Building upon the aforementioned foundations, a symbolic reasoning frame is designed to capture cryptojacking activities based on a behavior model. A series of Boolean-expression based filters is applied first to significantly reduce solution search space by three orders of magnitude. The fixed-packet-length communication behavior of Stratum protocol is then model by using linear diophantine equations. Since Stratum is predominantly used in cryptojacking, detection Stratum equals to finding out cryptojacking. By combining Netflow-plus traffic analysis and symbolic reasoning framework our system can deal with not only clear-text but encrypted traffic, and it achieved satisfactory detection results in a large campus network in real-time.