Cryptocurrencies malware based detection

1. A computer implemented method to identify a computer security threat based on communication of a network connected device via a computer network, the method comprising:

receiving a plurality of blocks of network traffic from the device, each of the plurality of blocks including a sequence of network traffic data items being identifiable by a position in the sequence of the block;

identifying a subset of positions occurring in every block for which a degree of variability of values of data items in each position of the subset meets a predetermined threshold; and

generating executable code for performing a plurality of processing operations based on the identified subset of positions, the executable code consuming a determinate quantity of computing resources when executed for the received network traffic,

wherein the executable code is suitable for detecting a subsequent network communication as a block of network traffic having a sequence of data items for which the identified subset of positions fails to exhibit a degree of variability meeting the predetermined threshold, the detection being based on a comparison of a measure of resources consumed by a computer system executing the executable code and the determinate quantity of computing resources, and the detection corresponding to the identification of a computer security threat.

2. The method of claim 1 , wherein the executable code is Ethereum code.

3. The method of claim 1 , wherein the device is an internet of things device.

4. The method of claim 1 , wherein the device has associated a unique identifier and the executable code has associated the unique identifier.

5. The method of claim 1 , wherein the predetermined threshold is defined to identify an absence of variability of values of data items in each position of the subset.

6. The method of claim 1 , wherein identifying a subset of positions includes using a machine learning algorithm to identify positions in every block at which data items exhibit at least a predetermined degree of consistency.

7. The method of claim 6 , wherein the machine learning algorithm is an unsupervised algorithm.

8. The method of claim 6 , wherein the machine learning algorithm is a restricted Boltzmann machine.

9. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer to perform the method as claimed in claim 1 .

10. The method of claim 7 , wherein the unsupervised algorithm is an autoencoder.

11. A computer system comprising:

a processor and memory storing computer program code for identifying a computer security threat based on communication of a network connected device via a computer network, the processor and memory configured to:

receive a plurality of blocks of network traffic from the device, each of the plurality of blocks including a sequence of network traffic data items being identifiable by a position in the sequence of the block;

identify a subset of positions occurring in every block for which a degree of variability of values of data items in each position of the subset meets a predetermined threshold; and

generate executable code for performing a plurality of processing operations based on the identified subset of positions, the executable code consuming a determinate quantity of computing resources when executed for the received network traffic,

wherein the executable code is suitable for detecting a subsequent network communication as a block of network traffic having a sequence of data items for which the identified subset of positions fails to exhibit a degree of variability meeting the predetermined threshold, the detection being based on a comparison of a measure of resources consumed by a computer system executing the executable code and the determinate quantity of computing resources, and the detection corresponding to the identification of a computer security threat.