設計與實作基於多重封包樣態比對之加密貨幣挖礦行為偵測

Design and Development of Multi-Pattern Matching Rules for Detecting Cryptocurrency Mining in Packet Inspection

蔡邦維(Pang-Wei Tsai)

《資訊安全通訊》 27卷1期 (2021/02) Pp. 41-51

摘要

近年來，運用區塊鏈技術所實作的加密貨幣及其相關應用逐漸在資訊金融領域間興起。因為在加密貨幣的交易過程中需要運用密碼學技術來進行雜湊計算，記帳過程中的參與者（礦工）會因為提供運算資源（挖礦）而獲得獎勵，故吸引了許多人投入。由於挖礦過程中所獲得的加密貨幣獎勵可以透過交易所與法幣進行換匯，因此也容易吸引有心人士透過不正當手段獲取運算資源進行挖礦。常見的手法包括以惡意軟體控制受駭設備進行挖礦，或者在網頁中嵌入腳本讓瀏覽網頁的使用者貢獻設備資源協助挖礦。本研究將以網路封包樣態檢測的角度切入，以常被惡意軟體所選擇挖掘的門羅幣為目標，分析挖礦軟體與礦機之間的溝通行為模式，再根據封包特徵值產出比對規則並進行實驗驗證。本研究中設計的規則可供網路管理人員搭配封包檢測系統使用，並能藉由規則所觸發的事件紀錄進一步追查，評估相關設備是否已淪為惡意軟體所控制的門羅幣礦機。

關鍵字

加密貨幣 ； 區塊鏈 ； 挖礦惡意軟體 ； 封包檢測

並列摘要

In recent years, cryptocurrency built by blockchain technology is getting more and more popular in both information technology and financial industries. Because of providing resources to support hash computing (known as mining) , participants (known as miners) will get cryptocurrency rewards. Therefore, it becomes the reason that attracts many people to join the mining process. Since exchanging cryptocurrency reward to legal money is possible, it interests people with bad intention to use improper means to obtain computing resources for mining, such as using malware to manipulate hacked equipment to install miner software or enabling drive-by download attack to acquire computing resource from web client. This research studies Monero, a cryptocurrency often selected by malwares, trying to investigate its communication progress between miner and mining pool, and extracts packets to get signatures for developing detection rules with corresponding patterns. The experiment results show that applied rules are able to detect suspicious networking activities related to Monero mining. By using implemented rules in this paper, it aims to help network administrators investigate whether the equipment have been infected by Monero mining malware.

並列關鍵字

Cryptocurrency ； Blockchain ； Mining Malware ； Packer Inspection

參考文獻

M. Blum, P. Feldman, and S. Micali, “Non-interactive zero-knowledge and its applications,” in proceedings of the Twentieth Annual ACM Symposium on Theory of Computing, pp.103-112, 1988.

P. Franco, Understanding bitcoin, Wiley, 2014.

R. Henry, A. Herzberg, and A. Kate, “Blockchain access privacy: Challenges and directions,” IEEE Security & Privacy, vol.16, no.4, pp.38-45, 2018.

M. Jakobsson and A. Juels, “Proofs of work and bread pudding protocols,” Secure Information Networks, pp.258-272, 1999.

E. Le Jamtel, “Swimming in the Monero pools,” in proceeding of the International conference on IT security incident management & IT forensics, pp.110-114, 2018.