摘要
過去所發生的挖礦攻擊事件中，以技術層面來看，大多為通過各種入侵手段將病毒植入目標主機中，並且使用進程隱藏技術試圖躲避防毒軟體的檢測，使病毒能夠長時間地操控主機上的CPU運算資源而不被發現。而現今隨著礦池概念的提出，執行挖礦任務不再需要如此大量的運算資源，礦工只需要加入礦池並且捐獻部分算力，就能夠取得挖礦獎勵的分配。從近年來發生的挖礦攻擊事件中能發現，開始出現少數病毒具有動態調整用於挖礦任務上的運算資源使用量，使得機器學習在訓練特徵上所需要的時間與複雜度增加。 本論文假設挖礦病毒除了具有大幅調用CPU硬體資源的行為，在系統使用率出現變化時病毒會表現出新的行為特徵。而本論文所提出的方法可以分為三部分，首先，透過巨量資料分析找出主機硬體資源的正常調用行為，來偵測CPU的異常狀態；其次，我們將在實驗環境中運行病毒，來觀察其在CPU上的調用情況，後續依照系統使用率的變化比例，來設置震盪幅度以及持續時間的門檻值，進而判定CPU異常是否為挖礦病毒程式所造成；最後，我們會透過暫停系統中使用率變化較大的幾支程式，並觀察系統使用率以及程式使用率間的變化，來確認系統中挖礦病毒程式的實體。實驗顯示，本論文所提出之檢測方法，除了能找出大量使用CPU資源的挖礦病毒之外，對於能動態調整資源使用量的病毒檢測也有相當傑出的成果。
並列摘要
In the past mining attacks, from a technical point of view, most of the viruses were implanted into the target host through various intrusion methods, and the process hiding technology was used to try to evade the detection of anti-virus software, so that the virus can control the host for a long time. Nowadays, with the introduction of the mining pool concept, the execution of mining tasks no longer requires such a large amount of computing resources. Miners only need to join the mining pool and donate part of the computing power to obtain the distribution of mining rewards. From the mining attacks in recent years, it can be found that a small number of viruses have begun to dynamically adjust the use of computing resources for mining tasks, which increases the time and complexity of training features for machine learning. This thesis assumes that in addition to the behavior of a mining virus that significantly invokes CPU hardware resources, the virus will show new behavior characteristics when the system usage changes. The method proposed in this paper can be divided into three parts. Firstly, the normal call behavior of the host hardware resources is found through the analysis of huge data to detect the abnormal state of the CPU; secondly, we will run the virus in the experimental environment. To observe its call on the CPU, and then set the threshold value of the oscillation amplitude and duration according to the change ratio of the system usage, and then determine whether the CPU abnormality is caused by the mining virus program; Finally, we will confirm the entity of the mining virus program in the system by suspending several programs in the system with large changes in usage and observing the changes in system usage and program usage. Experiments show that the detection method proposed in this paper can not only find mining viruses that use a large amount of CPU resources, but also has outstanding results for virus detection that can dynamically adjust resource usage.