Cryptomining Traffic Detection Based on BiGRU and Attention Mechanism

Abstract

The increasing popularity of cryptocurrencies has led to a rise in cryptomining attacks, where attackers unauthorizedly use the victim's computer resources to mine digital currency. This brings significant financial losses and security risks to both personal and professional life. Therefore, the detection of cryptomining attacks is of paramount importance. The conventional packet inspection technique is no longer effective due to the use of encryption. Moreover, the prevalent machine learning methods rely heavily on features extracted by professional experience, which is time-consuming. In this paper, we analyze the features of real-world campus cryptomining traffic and propose an end-to-end deep learning model for malicious mining detection. Our model, based on Bidirectional Gate Recurrent Unit (BiGRU) with an attention mechanism, extracts representative features from the raw flow. The results indicate that our approach outperforms benchmark models and previous methods on the large-scale imbalanced dataset, achieving a G-mean value of 0.99 with only 8 packets of a flow.