Detection and mitigation of cryptojacking
A method of monitoring network traffic for cryptojacking activity is provided. A request is received from a protected host. It is determined whether the request is a cryptocurrency request based on whether the request uses a protocol specified for requests belonging to the cryptocurrency communication. In response to a determination that the request is a cryptocurrency request for the cryptocurrency, a second request is submitted to a destination indicated by the request, wherein the second request is formatted as a cryptocurrency request for the cryptocurrency. A determination is made whether a reply to the second request from the destination is a cryptocurrency response for the cryptocurrency based on whether the response uses a protocol specified for a response that belongs to communication associated with the cryptocurrency. An intervention action is caused in response to a determination that the reply to the second request from the destination is a cryptocurrency response for the cryptocurrency.
1. A computer-implemented method of monitoring network traffic for cryptojacking activity, the method comprising:
receiving a first request from a protected host of a protected network;
determining whether the first request is a cryptocurrency request for a particular cryptocurrency of at least one cryptocurrency based on whether the request uses a protocol specified for requests that belong to communication associated with the particular cryptocurrency;
in response to a determination that the first request is a cryptocurrency request for the particular cryptocurrency, submitting a second request to a destination of the first request, wherein the second request is formatted as a cryptocurrency request for the particular cryptocurrency;
determining whether a reply to the second request from the destination is a cryptocurrency response for the cryptocurrency based on whether the reply uses a protocol specified for responses that belong to communication associated with the particular cryptocurrency; and
causing an intervention action in response to a determination that the reply to the second request from the destination is a cryptocurrency response for the particular cryptocurrency.
2. The computer-implemented method of claim 1 , further comprising, in response to a determination that the first request is not a cryptocurrency request for the particular cryptocurrency, forwarding the first request to its intended destination.
3. The computer-implemented method of claim 1 , further comprising, in response to a determination that the reply is not a cryptocurrency response for the particular cryptocurrency, forwarding the first request to its intended destination.
4. The computer-implemented method of claim 1 , wherein the intervention action includes at least one of adding the destination to a blacklist and dropping the first request.
5. The computer-implemented method of claim 1 , further comprising:
determining whether the destination is blacklisted; and
causing the intervention action in response to a determination that the destination is blacklisted.
6. The computer-implemented method of claim 5 , wherein the intervention action includes dropping the first request.
7. A computer system for monitoring network traffic for cryptojacking activity, comprising:
a memory configured to store instructions;
at least one processor disposed in communication with said memory, wherein instructions, upon execution by the at least one processor, cause the at least one processor to:
receive a first request from a protected host of a protected network;
determine whether the first request is a cryptocurrency request for a particular cryptocurrency of at least one cryptocurrency based on whether the request uses a protocol specified for requests that belong to communication associated with the particular cryptocurrency;
in response to a determination that the first request is a cryptocurrency request for the particular cryptocurrency, submit a second request to a destination of the first request, wherein the second request is formatted as a cryptocurrency request for the particular cryptocurrency;
determine whether a reply to the second request from the destination is a cryptocurrency response for the cryptocurrency based on whether the reply uses a protocol specified for responses that belong to communication associated with the particular cryptocurrency; and
cause an intervention action in response to a determination that the reply to the second request from the destination is a cryptocurrency response for the particular cryptocurrency.
8. The computer system of claim 7 , wherein the instructions, upon execution by the at least one processor, further cause the at least one processor to, in response to a determination that the first request is not a cryptocurrency request for the particular cryptocurrency, forward the first request for to its intended destination.
9. The computer system of claim 7 , wherein the instructions, upon execution by the at least one processor, further cause the at least one processor to, in response to a determination that the reply is not a cryptocurrency response for the particular cryptocurrency, forward the first request to its intended destination.
10. The computer system of claim 7 , wherein the intervention action includes at least one of adding the destination to a blacklist and dropping the first request.
11. The computer system of claim 7 , wherein the instructions, upon execution by the at least one processor, further cause the at least one processor to:
determine whether the destination is blacklisted; and
cause the intervention action in response to a determination that the destination is blacklisted.
12. The computer system of claim 11 , wherein the intervention action includes dropping the first request.
13. A non-transitory computer readable storage medium and one or more computer programs embedded therein, wherein the computer programs comprise instructions, which, when executed by a computer system, cause the computer system to:
receive a first request from a protected host of a protected network;
determine whether the first request is a cryptocurrency request for a particular cryptocurrency of at least one cryptocurrency based on whether the request uses a protocol specified for requests that belong to communication associated with the particular cryptocurrency;
in response to a determination that the first request is a cryptocurrency request for the particular cryptocurrency, submit a second request to a destination of the first request, wherein the second request is formatted as a cryptocurrency request for the particular cryptocurrency;
determine whether a reply to the second request from the destination is a cryptocurrency response for the particular cryptocurrency based on whether the reply uses a protocol specified for responses that belong to communication associated with the particular cryptocurrency; and
cause an intervention action in response to a determination that the reply to the second request from the destination is a cryptocurrency response for the particular cryptocurrency.
14. The non-transitory computer readable storage medium of claim 13 , wherein the computer programs, upon execution by the computer system, further cause the computer system to, in response to a determination that the first request is not a cryptocurrency request for the particular cryptocurrency, forward the first request to its intended destination.
15. The non-transitory computer readable storage medium of claim 13 , wherein the computer programs, upon execution by the computer system, further cause the computer system to, in response to a determination that the reply is not a cryptocurrency response for the particular cryptocurrency, forward the first request to its intended destination.
16. The non-transitory computer readable storage medium of claim 13 , wherein the intervention action includes at least one of adding the destination to a blacklist and dropping the first request.
17. The non-transitory computer readable storage medium of claim 13 , wherein the computer programs, upon execution by the computer system, further cause the computer system to:
determine whether the destination is blacklisted; and
cause the intervention action in response to a determination that the destination is blacklisted.
18. The non-transitory computer readable storage medium of claim 17 , wherein the intervention action includes dropping the first request.