The metadata aspect of Domain Names (DNs) enables us to perform a behavioral
study of DNs and detect if a DN is involved in in-browser cryptojacking. Thus,
we are motivated to study different temporal and behavioral aspects of DNs
involved in cryptojacking. We use temporal features such as query frequency and
query burst along with graph-based features such as degree and diameter, and
non-temporal features such as the string-based to detect if a DNs is suspect to
be involved in the in-browser cryptojacking. Then, we use them to train the
Machine Learning (ML) algorithms over different temporal granularities such as
2 hours datasets and complete dataset. Our results show DecisionTrees
classifier performs the best with 59.5% Recall on cryptojacked DN, while for
unsupervised learning, K-Means with K=2 perform the best. Similarity analysis
of the features reveals a minimal divergence between the cryptojacking DNs and
other already known malicious DNs. It also reveals the need for improvements in
the feature set of state-of-the-art methods to improve their accuracy in
detecting in-browser cryptojacking. As added analysis, our signature-based
analysis identifies that none-of-the Indian Government websites were involved
in cryptojacking during October-December 2021. However, based on the resource
utilization, we identify 10 DNs with different properties than others.
Abstract—The metadata aspect of Domain Names (DNs) enables us to perform a behavioral study of DNs and detect if a DN is involved in in-browser cryptojacking.
Thus, we are motivated to study different temporal and behavioral aspects of DNs involved in cryptojacking.
そこで我々は,暗号ジャッキングに関わるDNの時間的・行動的側面の異なる側面を研究する動機がある。
0.56
We use temporal features such as query frequency and query burst along with graphbased features such as degree and diameter, and non-temporal features such as the string-based to detect if a DNs is suspect to be involved in the in-browser cryptojacking.
Our results show DecisionTrees classifier performs the best with 59.5% Recall on cryptojacked DN, while for unsupervised learning, K-Means with K=2 perform the best.
It also reveals the need for improvements in the feature set of state-of-the-art methods to improve their accuracy in detecting in-browser cryptojacking.
As added analysis, our signature-based analysis identifies that none-of-the Indian Government websites were involved in cryptojacking during October-December 2021.
Cryptojacking is a distributed mining approach in which cyber-criminals perform cryptocurrency mining activities illegally over the Internet by infecting a user’s device.
Here, Crypto-miners illegally control the user’s device computational resources for cryptocurrency mining purposes either by
ここでは、暗号通貨マイニングの目的でユーザーのデバイスの計算資源を違法に制御する。
0.74
(a) installing malware that performs mining activities or
(a)鉱業活動を行うマルウェアのインストール
0.74
(b) when a user visits some URL/website, till the time user is active on the URL, in the background execute mining scripts on the user devices.
b) ユーザがURL/Webサイトを訪れたとき、ユーザがURLでアクティブになるまで、バックグラウンドでユーザデバイス上でマイニングスクリプトを実行する。
0.77
Such techniques facilitate the miners to get financial benefits without compromising their computational resources, cost, and sharing of the mining rewards with the compromised user.
Ameliorated with sanctions of a state on the mining processes, environmental concerns [1], and the adoption of cryptocurrencies, cryptojacking is increasing at an alarming pace and becoming a concern for cyber security experts [2], [3].
On the contrary, for evasion, cryptojackers techniques such as CPU limiting, code now use different obfuscation, payload hiding, and changing the used script frequently to evade naive detection approaches.
In one of the state-of-the-art approaches [17] (for details, refer to Section III), the authors presented an approach to detect suspicious domains using temporal and non-temporal properties of DNS records in the blockchain ecosystem.
They analyzed the DNS traffic records and identified temporal (i.e., time-series based) and nontemporal (i.e., non-time series based) properties to understand the actual behavior of DNs on two temporal granularities (i.e., 2H (sub-datasets of 2 hour duration) and ALL (complete dataset)).
As in-browser cryptojacking is one type of malicious/illicit activity, it motivates us to check if the approaches such as [17] can be used to detect in-browser cryptojacking.
Here, we check the impact of the metadata information on the detection of cryptojacking websites in two ways,
ここでは,暗号化サイトの検出におけるメタデータ情報の影響を2つの方法で確認する。
0.76
(i) we study and analyze the similarity between the features of inbrowser cryptojacking DNs and other malicious DNs and
i) ブラウザの暗号鍵DNと他の悪意のあるDNの特徴の類似性を研究・分析する。
0.76
(ii) we validate if existing state-of-the-art methods can detect the in-browser cryptojacking.
(ii)既存の最先端手法がブラウザ内暗号化を検知できるかどうかを検証する。
0.58
We observe DecisionTrees classifier performs the best with 59.5% Recall among other supervised ML algorithms, and 228 DNs show high similarity with malicious DNs across different temporal granularities using K-Mean with K=2.
Further, in the past Indian Government websites have witnessed in-browser cryptojacking [18].
さらに、過去のインド政府のウェブサイトでは、ブラウザ内での暗号鍵を目撃している[18]。
0.59
Thus, apart from the
ですから 別として
0.73
英語（論文から抽出）
日本語訳
スコア
above validations, we also perform an analysis of Indian Government websites from the cryptojacking perspective to know if any Indian Government website is under attack.
Here, we perform K-Mean clustering (because of the unavailability of ground truth) using resource utilization features to identify the DNs with distinct resource utilization.
Note that we understand that cryptojacking is dynamic (source code of websites may change over time), and Wayback Machine archives may provide old snap-shots of source codes.
Still, Wayback Machine does not log associated scripting codes, which is essential to us.
それでもwayback machineは、関連するスクリプティングコードをログ化していません。
0.61
Due to this unavailability of associated scripting codes and associated DNS for all Indian Government websites, we cannot use any state-of-the-art method such as [17] for the analysis.
Our analysis also identifies the distinct resource utilization by 10 Indian DNs, which should be investigated further.
また,本分析により,インドDN10種による資源利用の差異が明らかになった。
0.69
From this point forward, we refer to in-browser cryptojacking as cryptojacking interchangeably.
この点から、ブラウザ内暗号ジャッキングを相互に暗号化ジャッキングと呼ぶ。
0.54
In short, our main contributions are: • Comparative study: We present a comparative study of the various state-of-the-art techniques used to detect in-browser cryptojacking.
Here, we compare these stateof-the-art techniques based on the features used, classifier/method, dataset with the size, reported performance, and limitations.
We identify that no technique uses DNS records for the in-browser cryptojacking detection.
ブラウザ内暗号鍵検出にDNSレコードを使用する手法は存在しない。
0.73
• Similarity analysis between cryptojacking DNs and other malicious DNs revealed the minimal divergence between temporal features of malicious DNs and cryptojacking DNs.
• Effectiveness of the state-of-the-art methods such as [17] towards identifying cryptojacked DNs: Our validations reveal the need for improvement in the feature set of the state-of-the-art methods such as [17] to improve their performance in detecting in-browser cryptojacking.
• Analysis of Indian Government websites reveals that none-of-the Indian Government websites were involved in cryptojacking during October-December 2021, and the distinct resource utilization by 10 Indian Government DNs.
Static tools such as MinerRay [16] infer signatures of the hash function and use an intermediate representation (IR) of both JS, and WASM and inspect interactions between the client and cryptojacking module for detection.
In [20], the authors proposed a CPU usage metrics-based detector.
著者らは[20]で、CPU使用量に基づく検出器を提案した。
0.62
In contrast, in [21], the authors proposed an approach-based on the host performance counter-based features (i.e., CPU, memory, network usage, and running processes within a host) and network flowbased features (i.e., inbound/outbound flows from port 80 and 443 as Stratum mining protocol utilizes them).
Another dynamic approach-based tool called WebTestbench [19] uses system resources, energy consumption, network traffic, device temperature, and user experience.
While other approaches such as [12] analyze the CPU instruction during the opcode execution, and [11] analyze the execution patterns of JS and WASM code and CPU utilization for detection.
Apart from the aforementioned dynamic techniques, MINOS [13] uses image-based classification and deep learning techniques to distinguish between benign and cryptojacked (i.e., those that have WASM script) opcode.
Among hybrid approaches, MineSweeper [8] uses signature crawling, WebSocket traffic analysis, CPU usage analysis, code analysis of WebAssembly script, and memory cache events during the execution.
Similarly, approaches in [14] and [15] perform static analysis based on content-based, currency-based, and code-based, while dynamic analysis is based on CPU and battery consumption.
A content-based analysis is used to find the nature of websites such as entertainment and sports; a currency-based analysis is used to find the type of cryptocurrencies being mined through in-browser cryptojacking.
Unable to handle obfuscation techniques and Memory overhead
処理できない 難読化技術とメモリオーバーヘッド
0.65
Detects only hash modeled signatures
ハッシュモデルシグネチャのみを検出する
0.60
Performance validated on limited data
性能検証 限られたデータで
0.69
Performance and Time overhead
演目 時間のオーバーヘッドは
0.48
Address exclusively browser-based mining
専用ブラウザベースのマイニング
0.67
Performance validated on limited data
性能検証 限られたデータで
0.69
Limited mining samples Solely relying on the network traffic
特急 鉱業サンプル ネットワークトラフィックに依存している
0.59
Considers only WASM modules and does not support JS modules
WASMモジュールのみを考慮し、JSモジュールをサポートしない
0.82
Detect only CryptoNight miners, Do not support
CryptoNightマイナーのみを検出する、サポートしない
0.80
JS miners Scalability issue,
JSマイニング スケーラビリティの問題。
0.60
Code obfuscation and WASM are not considered
コード難読化と WASMは考慮されていない
0.63
Address exclusively browser-based mining
専用ブラウザベースのマイニング
0.67
Exclusively depends on vulnerabilities of
脆弱性にのみ依存する
0.76
CMS providerssuch as WordPress
WordPressのようなCMSプロバイダ
0.79
Hybrid dataset, CIC-IDS2018
ハイブリッドデータセットCIC-IDS2018
0.64
Self Generated PublicWWW
自己 生成 PublicWW
0.46
Pixalate Netlab360
Pixalate Netlab360
0.44
Self Generated Alexa, Majestic,
自己 生成 Alexa、Mageestic、
0.55
PublicWWW, [23] • Based on: S Signature, P Processor / CPU, M Memory, D Disk, N Network Analysis, C Code Analysis, O Opcode, H Hashing Algorithm, DN S Domain Name System, Oth Others, • Method: RF Random Forest, CN N Convolutional Neural Network, T LC Two-Level Classification, F CM Fuzzy C-Means, M ISV M Multiple-Instance Support Vector Machine, SM O Sequential Minimal Optimization, RandomSubSpace Random Subspace Method, • not used, used, − no specific mention,× times
公開。 [23] • sシグネチャ、pプロセッサ/cpu、mメモリ、dディスク、nネットワーク解析、cコード解析、oオペコード、hハッシュアルゴリズム、dn sドメイン名システム、oth その他、• メソッド:rfランダムフォレスト、cnn畳み込みニューラルネットワーク、t lc2レベル分類、fcmファジィc-means、m isvm多重インスタンスサポートベクターマシン、sm oシーケンシャル極小最適化、ランダムサブスペース乱数部分空間法、• s は使用されない、-特に言及されない、× 時間。 訳抜け防止モード: 公開。 [23] •S署名、Pプロセッサ/CPUに基づく。 Mメモリ、Dディスク、Nネットワーク分析、Cコード解析 O Opcode, H Hashing Algorithm, DN S Domain Name System, その他 •RFランダムフォレスト,CNN畳み込みニューラルネットワーク T LC Two - Level Classification, F CM Fuzzy C - Means M ISV M Multiple - Instance Support Vector Machine, SM O Sequential Minimal Optimization RandomSubSpace Random Subspace Method, • . . 使われていない。 -具体的な言及なし、×時間
0.54
by cryptojacking scripts.
スクリプトを暗号化して
0.55
Further, in [9], the authors introduced a cryptojacking campaigns detector based on the crawling and NetFlow data traffic.
They used WebAssembly, asm.js (a technique translating high-level code, like C and C++ to JavaScript), WebSockets, and Stratum Mining Protocol to detect cryptojacking.
These state-of-the-art approaches are summarized in Table I with the reported features, classifier/method, dataset used with the size, reported performance, and approach limitations.
III. METHODOLOGY Our approach follows the standard ML pipeline steps, including data collection, data pre-processing, feature engineering, ML algorithm, validation, and is motivated by [17], which identifies illicit DNs using temporal (i.e., time-series based) and non-temporal features.
In the pre-processing step, we collect the data, label it (as benign, malicious, and cryptojacking) using publicly available sources, and segment it into different temporal granularities.
Here, we extract all 48 temporal and non-temporal features (same as those in [17], due to space constraints, we do not list those features) and analyze the similarity (by comparing
the probability distribution) between the temporal properties of the cryptojacking DNs and other malicious DNs.
暗号ジャッキングDNと他の悪意のあるDNの時間的特性の間の確率分布)。
0.69
For the unsupervised ML, we first apply the reported unsupervised algorithm (as in [17]) to each 2H data segment and identify the illicit DNs that have a >99.0% probability of being malicious (computed as a ratio of the number of times a DN behaves maliciously and the total number of times the DN occurs).
Then we identify the number of cryptojacked DNs present in our suspicious list identified in the first step.
次に、疑わしいリストに存在する暗号化されたdnsの数を最初のステップで特定します。
0.65
For the supervised ML models, we apply the reported supervised ML model (DecisionTree Classifier in [17]) on ALL data granularity to identify cryptojacked DNs.
We also identify the best performing ML model along with the hyperparameters by configuring AutoML tools such as TPOT [25] with 11 different supervised ML algorithms with multiple combinations of their hyperparameters.
Applying unsupervised learning to All dataset will only provide one class to the DNs, while in the other case, for each dataset in 2H granularity, we will get a class for each DN.
Table II summarizes all list of resources we monitor.
Table IIは、監視するリソースのリストをすべてまとめたものです。
0.63
We do resource monitoring two times at an interval of 150 seconds and take the average of each measure we capture.
リソース監視は150秒の間隔で2回実施し、キャプチャした各測定値の平均を取得します。
0.82
We then analyze the collected data based on clustering and graph connectivity.
収集したデータをクラスタリングとグラフ接続に基づいて分析する。
0.77
We perform clustering to identify the DNs with distinct resource utilization and graph connectivity to analyze the association between the DNS records.
リソース利用の異なるDNとグラフ接続をクラスタリングして,DNSレコード間の関連性を分析する。
0.69
IV. VALIDATION AND RESULT ANALYSIS
IV。 バリデーションおよびレスポンス分析
0.50
We analyze the similarity between the cryptojacked DNs and malicious DNs and validate the effectiveness of the DNbased state-of-the-art such as [17] to detect the cryptojacking DNs.
disk read disk write net recv net send pkt total pkt send pkt rec pkt oth
ディスク読み取りディスク書き込みネットrevnet send pkt total pkt send pkt rec pkt oth
0.74
TABLE II: Resources measures
TABLE II: 資源対策
0.81
Description % CPU used by user level applications % CPU used by user level nice priority % CPU used by system level process % CPU idle time during which system had an outstanding disk I/O request % time spent in involuntary wait by the virtual CPU % time that CPU was idle and the system did not have an outstanding disk I/O request # transfers per second that were issued to sda amount of blocks read/sec from sda amount of blocks written/sec to sda # blocks read # blocks written disk reads disk writes network receive network send total packets packets send packets received other packets
Description % CPU used by user level applications % CPU used by user level nice priority % CPU used by system level process % CPU idle time during which system had an outstanding disk I/O request % time spent in involuntary wait by the virtual CPU % time that CPU was idle and the system did not have an outstanding disk I/O request # transfers per second that were issued to sda amount of blocks read/sec from sda amount of blocks written/sec to sda # blocks read # blocks written disk reads disk writes network receive network send total packets packets send packets received other packets 訳抜け防止モード: ユーザレベルで使用されるCPU % ユーザレベルで使用されるCPU % ユーザの優先度 % システムレベルで使用されるCPU % システムレベルで使用されるCPU % 未使用のディスクI/O要求時のCPUアイドル時間 % 仮想CPU % アイドル時間 また、システムにはディスクI/Oリクエスト#転送がない。sda ブロックの sda ブロックの sda ブロックから sec ブロックへの sda ブロックの読み込み/ sec ブロックから sda ブロックへの sda ブロックの読み込み # ディスクの読み込み ディスクの読み込み 書き込みネットワークの受信パケットの送信 パケットの送信 他のパケットの送信
0.82
Of these, ≈1.77 million DNS queries are distinct, and 42002 DNS queries have the malicious tag (from [17]).
For ground truth on cryptojacking DNs, we use CoinHive BlackList [27], CoinHive Domains [28], CoinHive Pixalate [29], Cryptocurrency Mining List [30], Cryptojacking Campaign List [31], KnownCryptoURL [32], MinerBlock List [33], NoCoin BlackList [34], Top Web Mining Sites [35], and the other websites such as [9].
暗号化dnsに関する根拠は、coinhive blacklist [27], coinhive domains [28], coinhive pixalate [29], crypto mining list [30], cryptojacking campaign list [31], knowncryptourl [32], minerblock list [33], nocoin blacklist [34], top web mining sites [35], そして [9]のような他のwebサイトを使用する。
0.68
We understand that some of these lists might be outdated, but we use them for the sake of completeness.
これらのリストのいくつかは時代遅れかもしれませんが、完全性のために使用しています。
0.55
There are 29777 unique cryptojacked DNs/TLDs (top-level domains) present in these lists.
B. Similarity analysis between Cryptojacking DNs and Other Malicious DNs
B. クリプトジャックDNと他の悪性DNの類似性解析
0.75
We compare the distribution of temporal properties such as query frequency, query frequency burst, degree, and diameter associated with cryptojacked DNs and other malicious DNs for the similarity analysis.
Here, we measure the behavioral similarity between the in-browser cryptojacked DNs (cDNs) and malicious DNs (mDNs) to decide whether a DN-based approach such as [17] can detect cryptojacking DNs.
For this, we use ALL granularity data of the Cisco Umbrella dataset.
このために、私たちはCisco Umbrellaデータセットの全粒度データを使用します。
0.71
First, we study the distribution of the number of query frequency (#QFreq) and the maximum query frequency
まず,クエリ回数(#QFreq)と最大クエリ頻度の分布について検討する。
0.62
英語（論文から抽出）
日本語訳
スコア
(a) Query Frequency (b) Query Frequency Bursts
(a)クエリ周波数 (b)クエリー周波数バースト
0.85
(c) Degree (d) Diameter
(c)デグリー (d)直径
0.48
(e) CPU utilization using iostat -c
(e)iostat-cを用いたCPU利用
0.77
(f) Device utilization using iostat -d sda
f) iostat-d sda を用いたデバイス利用
0.89
(g) Disk utilization using dstat –disk
(g)dstat-diskを用いたディスク利用
0.84
(h) Network resources using pyshark
(h)pysharkを用いたネットワークリソース
0.80
Fig. 1: Cumulative distribution of different temporal properties and resource measures.
第1図:異なる時間特性と資源測度の累積分布。
0.72
(maxQFreq) to analyze the similarity in query frequency.
(maxQFreq) クエリ周波数の類似性を分析する。
0.83
Figure 1a shows that the exponential distribution fits #QFreq for the mDN class with xmin=1.0 and λ=0.0400, while a positive log-normal distribution fits the cDN class with xmin=1.0, µ=1.7092, and σ=1.4067.
Similarly, for the maxQFreq, Figure 1a shows that the exponential distribution fits for both classes with xmin=1.0 and λ={0.0793, 0.0852}, respectively.
Next, we analyze the query frequency burst (cf. Figure 1b).
次に、クエリ周波数バーストを分析する(図1b)。
0.63
A query frequency burst is the frequency of a DNS query which is more than a predefined value (i.e., 80% of the maximum number of DNS queries of a DN during a time frame).
クエリ頻度バースト(Query frequency burst)は、事前に定義された値(つまり、時間フレーム中のDNのDNSクエリの最大数の80%)以上のDNSクエリの頻度である。
0.78
We compare the distributions of the number of query bursts (#bursts) and the maximum size of query burst (maxBurst) for each mDN and cDN class.
This analysis also indicates that the two classes have the same statistical property with small divergence and will not impact the performance of [17] when detecting cryptojacking DNs.
Here, we compare the distributions of the number of times degree changes (#chDeg) and the maximum size of a degree (maxDeg) over time for each class of DNs.
Figure 1c shows no valid fits for both classes out of exponential, positive log-normal, truncatedpower-law, and power-law distributions for the #chDeg.
図1cは、指数関数的、正の対数正規化、truncatedpower-law、および#chDegのパワーロー分布から両方のクラスに有効な適合性を示す。 訳抜け防止モード: 図1cは指数関数から両方のクラスに有効でないことを示す。 positive log - normal, truncated power - law, and power - law distributions for the # chDeg
0.67
Similarly, for the maxDeg, Figure 1c shows a positive log-normal distribution for mDN class with xmin=1.0, µ=0.6831, and σ=0.9453, and exponential distribution for cDN class with
Next, we analyze the diameter for both classes (cf. Figure 1d).
次に、両方のクラス(図1d)の直径を分析する。
0.73
We study the distributions of the number of times diameter changes (#chDia) and maximum diameter change (maxchDia).
最大径変化数 (#chDia) と最大径変化数 (maxchDia) の分布について検討した。
0.72
We observe the positive log-normal distribution fits for both classes of DNs with xmin=1.0, µ={0.1741, 0.0532}, and σ={0.3773, 0.3986} for the #chDia, respectively.
We also observe that positive log-normal distribution fits the best both class with xmin=1.0, µ={1.0906, 0.9939}, and σ={0.2856, 0.2499} for the maxchDia, respectively.
From the above similarity analysis, we observe divergence in some features of the cDNs and mDNs.
以上の類似性分析から,cDNsとmDNsの特徴の相違を観察する。
0.70
Thus, the state-ofthe-art feature vector (used for detecting the malicious DNs, i.e., [17]) can detect cryptojacking DNs, but some improvements are needed, and new features should be included.
To understand if there is an impact on the performance of state-of-the-art methods such as [17] in identifying cryptojacked DNs/web pages, we perform validations using reported unsupervised and supervised algorithms.
1) Validation of an unsupervised model of [17]: We apply K-Means (an unsupervised learning method) to each 2H data segment with different values of K∈[7,24].
The obtained results contain a series of labels for each granularity representing the number of times a particular DN showed malicious behavior.
得られた結果は、特定のDNが悪意のある振る舞いを示した回数を表す粒度ごとに一連のラベルを含む。
0.71
Among the 9681 cryptojacked DNs (those previously unmarked in the dataset), 9339 DNs show malicious behavior at least once.
9681の暗号ジャックされたDNのうち、9339のDNは少なくとも一度は悪意のある振る舞いを示す。
0.70
While only 228 DNs have the probability of being malicious >99.0%.
228のDNだけが悪意のある99.0%の確率を持つ。
0.78
Now because we know the ground truth of these 228 DNs is cryptojacked, we can affirmatively say that the approach in [17] is effective and is able to detect cryptojacked DNS.
To validate the reported model for detecting the cryptojacked DNs, we perform an 80%-20% split of the dataset as well as the unmarked and cryptojacked DNs.
We apply the DecisionTrees Classifier with the same hyperparameters, i.e., criterion=gini, max depth=10, min samples leaf=13, min samples split=12, splitter=best.
同じハイパーパラメータを持つdecisiontrees分類器、すなわち criterion=gini, max depth=10, min sample leaf=13, min sample split=12, splitter=best を適用する。
0.74
Here, other hyperparameters have default values used by the Python scikit-learn
Thus, next, we validate if there is any other supervised ML model that gives improved results?
次に、改善された結果をもたらす他の教師付きMLモデルが存在するかどうかを検証する。
0.61
D. Identification of Improved ML Model
D.改良MLモデルの同定
0.83
in our case but also report
私たちの場合だけでなく
0.49
To identify the supervised ML model that provides better results when identifying the cryptojacking DNs, we perform two tests using different data configurations (based on the distribution of cryptojacked DNs in the dataset).
(ii) based on resource utilization, i.e., CPU, Device, Disk, and Network, and
(二)資源利用、すなわちCPU、デバイス、ディスク、ネットワークに基づくもの
0.58
(iii) based on the association between the DNS records of websites (i.e., DN, associated IP addresses, Name-Server, and Country).
(iii)WebサイトのDNSレコード(DN、関連するIPアドレス、ネームサーバ、カントリー)の関連に基づく。 訳抜け防止モード: (iii) webサイトのdnsレコード(すなわち、dnsレコード)間の関係に基づいて dn, associated ip address, name - server, and country )。
0.75
With signature crawling, we identify the cryptojacking DNs based on the past reported signatures and mark them as suspicious for further analysis.
The crawler opens each webpage associated with a DN using selenium webdriver, reads it, and searches the existence of 66 cryptojacking signatures in its HTML code and all associated script codes.
Next, we analyze resource utilization for each webpage using iostat-c to measure the CPU utilization (cf. Figure 1e), iostat-d sda to measure the device utilization (cf. Figure 1f), and dstat-disk-net to measure the disk utilization statistics (cf. Figure 1g).
次に、iostat-cを用いて各Webページのリソース利用状況を分析し、CPU利用率(cf.1e)、iostat-d sdaを用いてデバイス利用率(cf.1f)、dstat-disk-netを用いてディスク利用率(cf.1g)を測定した。 訳抜け防止モード: 次に、iostat - cを用いて各ウェブページのリソース利用率を分析し、cpu利用率を計測する(図1e)。 iostat - d sda デバイス使用率測定(図 1f)。 dstat - disk - net ディスク利用統計(cf. 図1g)を測定する。
0.80
We also use the PyShark wrapper to analyze live network packets (cf. Figure 1h).
また、PySharkラッパーを使用して、ライブネットワークパケットを分析する(図1h)。
0.73
We set the PyShark timeout to 30 sec, the selenium webdriver timeout to 90 sec, and the time gap between two resource measuring points to 150 sec for resource and network analysis.
We perform this analysis from November to December 2021 and record the 19 resource measures (cf. Table II).
この分析を2021年11月から12月にかけて実施し,19の資源対策(第2表)を記録する。
0.68
From Figure 1e, we infer that the truncated-powerlaw best fits cpu iowait with α=1.54 and λ=0.118 and the positive lognormal fits for cpu user, cpu system, and cpu idle with µ={-5.08, -5.36, -14.24}, σ={1.57, 1.53, 3.65}, respectively.
Here, xmin is 0.015 for the all four CPU measures.
ここでは、xminは4つのCPU測度すべてに対して0.015である。
0.56
Similarly, from Figure 1f, we infer that the positive log-normal distribution fits sda tps, sda kB read/s, and sda kB wrtn/s with xmin={0.01, 0.01, 0.02}, α={1.75, 1.47, 1.71} and λ={0.001, 0.0005, 0.06}, respectively.
Next, Figure 1g shows truncated-powerlaw best fits disk read with xmin=1.0, α=2.20 and λ=2.72 and a positive log-normal distribution best fits disk write with xmin=0.1, µ=0.19, σ=0.54.
Similarly, Figure 1h shows truncated-powerlaw best fits pkt oth with xmin=1.0, α=1.0 and λ=0.006 and the positive log-normal fits best for pkt total, pkt send, and pkt rec with xmin=1.0, µ={2.82, 1.58, 1.37}, σ={1.42, 1.26, 1.28}, respectively.
同様に、図1hはpkt othにxmin=1.0、α=1.0、λ=0.006、正の対数正規はpktの合計、pktの送信、xmin=1.0、μ={2.82、 1.58、 1.37}、σ={1.42、 1.26、 1.28}にそれぞれ適合する。 訳抜け防止モード: 同様に図1hは、truncated - powerlaw is pkt oth with xmin=1.0, α=1.0 と λ=0.006 と正の対数-正規は pkt に最も適している。 pkt send, and pkt rec with xmin=1.0, μ={2.82, 1.58, 1.37 }, σ={1.42, 1.26, 1.28 }, respectively .
0.66
Further, we apply the K-Means algorithm to the entire recorded dataset to cluster the DNs with K∈[2, 15].
Our choice (range on K) is based on the data size.
我々の選択(k 上の範囲)はデータサイズに基づいている。
0.81
We choose the best K based on the silhouette score.
シルエットスコアに基づいてベストKを選択します。
0.64
We check the silhouette score for different values of K and find K=2 provides the best silhouette score of 0.975 (different silhouette scores obtained for different
After exploring the clusters obtained for K=2, we find that one cluster has 8624 DNs while the second cluster has only 10 DNs, indicating that these 10 DNs have different properties than the others and should be monitored.
Note that we do not use supervised ML algorithms such as DecisionTree for the analysis due to the unavailability of the ground truth of Indian Government websites.
After the signature crawling and resource utilization, we extract features for each DN using the whois and tldextract.
署名クロールと資源利用の後,各DNの特徴をhoisおよびtldextractを用いて抽出する。
0.78
These features are: subdomain, registered domain, creation date, updated date, age, last updated age, Country, A Record (IPv4 Address record), AAAA Record (IPv6 Address record), NS (Name Server), MX (Mail Exchanger), TXT (Text), CNAME (Canonical Name), DNAME (Delegation Name), SOA (Start of Authority).
サブドメイン、登録ドメイン、作成日、更新日、年代、最後の更新年、国、Aレコード(IPv4アドレスレコード)、AAAAレコード(IPv6アドレスレコード)、NS(Name Server)、MX(Mail Exchanger)、TXT(Text)、CNAME(Canonical Name)、DNAME(Delegation Name)、SOA(Start of Authority)である。
0.68
Next, we build a graph using IP and NS addresses.
次に,IPアドレスとNSアドレスを用いてグラフを構築する。
0.76
We identify 7 connected components in the graph, and 8658 out of 8669 webpages lie in the largest component, where all the DNs are hosted on National Informatics Center servers.
We find one DN each is hosted in countries such as Iceland, Canada, United Kingdom, Singapore, Netherlands, Belize, China, Hong Kong, Hong Kong, Indonesia, Ukraine, Romania, Japan, Panama, Brazil, Belarus, France, and Switzerland.
In this work, we validate a metadata-based technique [17] to detect the in-browser cryptojacking DNs.
そこで本研究では,ブラウザ内暗号鍵DNを検出するメタデータベースの手法[17]を検証する。
0.67
This technique uses metadata information of DNs and associated temporal and non-temporal properties for malicious DNs detection.
この手法はDNのメタデータ情報と関連する時間的・非時間的特性を用いて悪意のあるDNを検出する。
0.59
We also perform a comparative study of various techniques that detect in-browser cryptojacking DNs.
また、ブラウザ内暗号鍵DNを検出する様々な手法の比較研究を行う。
0.68
Our analysis shows behavior similarity exists between the cryptojacking DNs and other suspicious DNs.
我々の分析は、暗号鍵DNと他の疑わしいDNの間に行動類似性が存在することを示している。
0.52
At the same time, there is a need for improvement in the feature set of [17] to improve the results of the approach.
同時に、アプローチの結果を改善するために[17]の機能セットを改善する必要がある。
0.58
Our signature-based analysis also identifies that none-of-the Indian Government websites listed in [26] were involved in in-browser cryptojacking from October-December 2021.
Our resource utilization analysis finds different resource utilization by 10 DNs.
資源利用分析の結果,資源利用量は10DNで異なることがわかった。
0.61
Such DNs require continuous and detailed behavior analysis before marking them as suspects.
このようなDNは、容疑者としてマークする前に、連続的で詳細な行動分析を必要とする。
0.43
Finally, we conclude that we need
最後に、私たちは必要と結論付けます。
0.50
英語（論文から抽出）
日本語訳
スコア
[17] R. K. Sachan, R. Agarwal, and S. K. Shukla, “Identifying malicious accounts in blockchains using domain names and associated temporal properties,” arXiv preprint arXiv:2106.13420, 2021.
arxiv preprint arxiv:2106.13420, 2021. [17] r. k. sachan, r. agarwal, s. k. shukla, “ドメイン名と関連する時間的特性を使って、ブロックチェーン内の悪意のあるアカウントを識別する”。 訳抜け防止モード: [17 ]R.K.サチャン、R.Agarwal、S.K. Shukla ドメイン名と関連する時間的特性を使ってブロックチェーン内の悪意のあるアカウントを識別する” arXiv preprint arXiv:2106.13420, 2021.”。
0.67
[18] N. Christopher, “Hackers mined a fortune from Indian websites,” 2018.
N. Christopher, “Hackers mined a fortune from Indian website”[18]N. Christopher, 2018。
0.44
Accessed: 28/10/2021.
アクセス:28/10/2021。
0.47
[19] P. Papadopoulos, P. Ilia, and E. Markatos, “Truth in web mining: Measuring the profitability and the imposed overheads of cryptojacking,” in International Conference on Information Security, pp. 277–296, Springer, 2019.
P. Papadopoulos, P. Ilia, and E. Markatos, “Trruth in web mining: Measurementing the profitability and the imposed overheads of Cryptojacking” in International Conference on Information Security, pp. 277–296, Springer, 2019. ] 訳抜け防止モード: [19 ]P. Papadopoulos, P. Ilia, E. Markatos ウェブマイニングの真理」 暗号鍵の収益性と課せられるオーバーヘッドを測る」と説明した。 In International Conference on Information Security, pp. 277-296, Springer, 2019
0.82
[20] F. Gomes and M. Correia, “Cryptojacking detection with cpu usage metrics,” in 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA), pp. 1–10, IEEE, 2020.
20] f. gomes and m. correia, “cryptojacking detection with cpu usage metrics” in 2020 ieee 19th international symposium on network computing and applications (nca), pp. 1–10, ieee, 2020。 訳抜け防止モード: 20 ] f. gomes と m. correia, “cpu使用量メトリクスによる暗号化検出” 2020年ieee 19th international symposium on network computing and applications (nca) 第1-10巻、ieee、2020年。
0.72
[21] G. Gomes, L. Dias, and M. Correia, “Cryingjackpot: Network flows and performance counters against cryptojacking,” in 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA), pp. 1–10, IEEE, 2020.
21] g. gomes, l. dias, and m. correia, “cryingjackpot: network flow and performance counters against cryptojacking” in 2020 ieee 19th international symposium on network computing and applications (nca), pp. 1–10, ieee, 2020 訳抜け防止モード: [21 ]G. Gomes,L. Dias,M. Correia 2020年IEEE 19th International Symposium on Network Computing における「Cryingjackpot : Network Flow and Performance counters against Cryptojacking」 and Applications (NCA ), pp . 1-10, IEEE, 2020。
0.45
[22] M. Caprolu, S. Raponi, G. Oligeri, and R. Di Pietro, “Cryptomining makes noise: Detecting cryptojacking via machine learning,” Computer Communications, vol.
22] m. caprolu, s. raponi, g. oligeri, r. di pietro, “cryptomining makes noise: detection cryptojacking via machine learning”, computer communications, vol. “暗号化はノイズを発生させる。
[24] E. Tekiner, A. Acar, A. S. Uluagac, E. Kirda, and A. A. Selcuk, “Sok: Cryptojacking malware,” in IEEE European Symposium on Security and Privacy (EuroS&P), (virtual), pp. 120–139, 09 2021.
E. Tekiner, A. Acar, A. S. Uluagac, E. Kirda, and A. A. Selcuk, “Sok: Cryptojacking malware” in IEEE European Symposium on Security and Privacy (EuroS&P), (virtual), pp. 120–139, 09 2021。
0.43
[25] R. Olson and J. Moore, “Tpot: A tree-based pipeline optimization tool for automating machine learning,” in Workshop on Automatic Machine Learning, (New York, New York, USA), pp. 66–74, PMLR, 06 2016.
R. Olson, J. Moore, “Tpot: a tree-based pipeline optimization tool for automation machine learning” in Workshop on Automatic Machine Learning, (New York, New York, USA), pp. 66–74, PMLR, 06 2016 訳抜け防止モード: [25 ] R. Olson, J. Moore, “Tpot : A tree-based pipeline optimization tool for automation machine learning” 自動機械学習ワークショップ(ニューヨーク、ニューヨーク、アメリカ) pp. 66-74 , PMLR , 06 2016。
0.78
Accessed: “Integrated Government Online Directory.”
アクセス: 「統合政府オンラインディレクトリ」
0.71
[26] IGOD, 05/08/2021.
[26]IGOD, 05/08/2021.
0.30
[27] “CoinHive BlackList.”
[27]『CoinHive BlackList』
0.55
Accessed: 29/06/2021.
アクセス:29/06/2021。
0.48
[28] “CoinHive Domains.”
[28]「CoinHive Domains」
0.58
Accessed: 29/06/2021.
アクセス:29/06/2021。
0.48
[29] “CoinHive Pixalate.”
[29]「CoinHive Pixalate」
0.28
Accessed: 18/08/2021.
アクセス:18/08/2021。
0.49
[30] “Cryptocurrency Mining List.”
【30】「暗号通貨マイニングリスト」
0.65
Accessed: 15/07/2021.
アクセス:15/07/2021。
0.49
[31] “CryptoJacking Campaign List.”
[31]「CryptoJacking Campaign List」
0.62
Accessed: 19/08/2021.
アクセス:19/08/2021。
0.49
[32] “Known Crypto URL.”
[32]“Known Crypto URL”。
0.35
Accessed: 19/08/2021.
アクセス:19/08/2021。
0.49
[33] “Miner Block List.”
[33]「マイナーブロックリスト」。
0.55
Accessed: 29/06/2021.
アクセス:29/06/2021。
0.48
[34] “NoCoin Black List.”
[34]「NoCoin Black List」
0.63
Accessed: 29/06/2021.
アクセス:29/06/2021。
0.48
[35] “Top Web Mining Sites.”
[35]「トップwebマイニングサイト」
0.54
Accessed: 19/08/2021.
アクセス:19/08/2021。
0.49
to enhance the feature set of the metadata-based approach with resources and network analysis-based features.
リソースとネットワーク分析に基づく機能を備えたメタデータベースのアプローチの特徴セットを強化する。
0.78
In the future, we would like to improve the metadata-based approach and test it in a large dataset to detect in-browser cryptojacking.
This work is partially funded by the National Blockchain Project at IIT Kanpur, sponsored by the National Cyber Security Coordinator’s office of the Government of India, and partially by the C3i Hub funding from the Department of Science and Technology of the Government of India.
[6] S. Varlioglu, B. Gonen, M. Ozer, and M. Bastug, “Is cryptojacking dead after coinhive shutdown?,” in 3rd International Conference on Information and Computer Technologies (ICICT), (San Jose, USA), pp. 385–389, IEEE, 05 2020.
6] S. Varlioglu, B. Gonen, M. Ozer, M. Bastug, “Is cryptojacking dead after coinhive shutdown?” in 3rd International Conference on Information and Computer Technologies (ICICT), (San Jose, USA), pp. 385–389, IEEE, 05 2020。 訳抜け防止モード: 6 ] s. varlioglu, b. gonen, m. ozer, そしてm. bastugは、”coinhiveのシャットダウンでcryptojackingは死んだのか? 第3回情報・コンピュータ技術国際会議(icict)に参加して (サンノゼ,usa) pp. 385-389, ieee, 05 2020 .
0.75
[7] G. Hong, Z. Yang, S. Yang, et al , “How you get shot in the back: A systematical study about cryptojacking in the real world,” in SIGSAC Conference on Computer and Communications Security, pp. 1701–1713, ACM, 2018.
G. Hong, Z. Yang, S. Yang, et al , “How you get shot in the back: A systematical study aboutcryptjacking in the real world”. SIGSAC Conference on Computer and Communications Security, pp. 1701–1713, ACM, 2018. 訳抜け防止モード: [7]G.Hong,Z.Yang,S.Yang ,その他 裏でどのように撃たれるか : 現実世界の暗号ジャックに関する体系的研究」 SIGSAC Conference on Computer and Communications Security, pp. 1701–1713, ACM, 2018
0.75
[8] R. K. Konoth, E. Vineti, V. Moonsamy, M. Lindorfer, C. Kruegel, H. Bos, and G. Vigna, “Minesweeper: An in-depth look into driveby cryptocurrency mining and its defense,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1714–1730, 2018.
R.K. Konoth, E. Vineti, V. Moonsamy, M. Lindorfer, C. Kruegel, H. Bos, G. Vigna, “Minesweeper: An in-epth look in driveby crypto mining and its Defense” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1714–1730, 2018。 訳抜け防止モード: [8 ]R. K. Konoth, E. Vineti, V. Moonsamy M. Lindorfer、C. Kruegel、H. Bos、G. Vigna。 「マイナスウィーパー : ドライブバイ・暗号通貨採掘とその防衛について深い考察」 2018 ACM SIGSAC Conference on Computer and Communications Security に参加して pp . 1714–1730 , 2018 .
0.87
[9] H. L. J. Bijmans, T. M. Booij, and C. Doerr, “Inadvertently making cyber criminals rich: A comprehensive study of cryptojacking campaigns at internet scale,” in 28th USENIX Security Symposium USENIX Security 19), pp. 1627–1644, 2019.
9] h. l. j. bijmans, t. m. booij, c. doerr, "不注意にサイバー犯罪者を豊かにすること: インターネット規模での暗号ハッキングキャンペーンの包括的な研究" 第28回usenix security symposium usenix security 19), pp. 1627–1644, 2019 で紹介された。
0.62
[10] R. Ning, C. Wang, C. Xin, J. Li, L. Zhu, and H. Wu, “Capjack: Capture in-browser crypto-jacking by deep capsule network through behavioral analysis,” in IEEE INFOCOM 2019-IEEE Conference on Computer Communications, pp. 1873–1881, IEEE, 2019.
[10] r. ning, c. wang, c. xin, j. li, l. zhu, and h. wu, “capjack: capture in-browser crypto-jacking by deep capsule network through behavior analysis” in ieee infocom 2019-ieee conference on computer communications, pp. 1873–1881, ieee, 2019” (英語) 訳抜け防止モード: [10 ]R.Ning,C.Wang,C.Xin, J. Li, L. Zhu, and H. Wu, “Capjack : Capture in - browser Crypto - Jacking by Deep capsule network through behavioral analysis” と題している。 in IEEE INFOCOM 2019-IEEE Conference on Computer Communications, pp. 1873–1881, IEEE, 2019
I. Petrov, and L. [12] D. Carlin, P. O’kane, S. Sezer, and J. Burgess, “Detecting cryptomining using dynamic analysis,” in 2018 16th Annual Conference on Privacy, Security and Trust (PST), pp. 1–6, IEEE, 2018.
ペトロフ、L。 12] d. carlin, p. o’kane, s. sezer, j. burgess, “ detectioning cryptomining using dynamic analysis” 2018年第16回年次カンファレンス on privacy, security and trust (pst), pp. 1–6, ieee, 2018年。
0.55
[13] F. Naseem, A. Aris, L. Babun, E. Tekiner, and A. S. Uluagac, “Minos*: A lightweight real-time cryptojacking detection system,” in Network and Distributed Systems Security (NDSS) Symposium, pp. 21–25, 2021.
F. Naseem, A. Aris, L. Babun, E. Tekiner, A. S. Uluagac, “Minos*: a lightweight real-time cryptojacking detection system” in Network and Distributed Systems Security (NDSS) Symposium, pp. 21–25, 2021.
0.46
[14] M. Saad, A. Khormali, and A. Mohaisen, “End-to-end analysis of in-
14]saad, a. khormali, a. mohaisen, "inのエンドツーエンド解析-
[15] M. Saad, A. Khormali, and A. Mohaisen, “Dine and dash: Static, dynamic, and economic analysis of in-browser cryptojacking,” in APWG Symposium on Electronic Crime Research (eCrime) 2019, pp. 1–12, IEEE, 2019.
M. Saad, A. Khormali, and A. Mohaisen, “Dine and dash: Static, dynamic, and Economic analysis of in-Browser Cryptojacking”. APWG Symposium on Electronic Crime Research (eCrime) 2019, pp. 1–12, IEEE, 2019. 訳抜け防止モード: [15 ]M. Saad, A. Khormali, A. Mohaisen ダイニング・アンド・ダッシュ : in-ブラウザ・暗号ジャックの静的・動的・経済的分析」 APWG Symposium on Electronic Crime Research (eCrime ) 2019 に参加して pp. 1-12 , IEEE , 2019 。
0.83
[16] A. Romano, Y. Zheng, and W. Wang, “Minerray: semantics-aware analysis for ever-evolving cryptojacking detection,” in 2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE), pp. 1129–1140, IEEE, 2020.
16] a. romano, y. zheng, and w. wang, “minerray: semantics-aware analysis for ever-evolving cryptojacking detection” in 2020 35th ieee/acm international conference on automated software engineering (ase), pp. 1129–1140, ieee, 2020。 訳抜け防止モード: [16 ]A. Romano, Y. Zheng, W. Wang マイナレイ : セマンティクス - これまでになく意識的な分析 - 暗号鍵検出の進化”。 2020年の第35回IEEE / ACM International Conference on Automated Software Engineering (ASE) pp. 1129–1140 , IEEE , 2020 。