New research from the US National Laboratory: Using artificial intelligence to thwart illegal cryptocurrency mining

On August 21, according to The Block, the U.S. Department of Energy's National Nuclear Security Administration's Los Alamos National Laboratory has developed an artificial intelligence (AI)-based system that can detect illegal cryptocurrency mining programs. Los Alamos Laboratory said the research was published in the IEEE Access magazine on July 27, 2020.

Analysis based on graphic comparison

On August 20, Los Alamos National Laboratory announced that computer scientists at the laboratory have developed a new AI system that may be able to identify malicious code that hijacks supercomputers to mine cryptocurrencies such as Bitcoin and Monero.

“Based on recent computer intrusions in Europe and elsewhere, this type of software watchdog will soon be key to preventing cryptocurrency miners from hacking into high-performance computing facilities and stealing valuable computing resources,” said Gopinath Chennupati, a researcher at the lab. “Our deep learning AI model is designed to detect the misuse of supercomputers, especially for cryptocurrency mining.”

Legitimate cryptocurrency miners typically assemble huge computer matrices dedicated to mining. A few miners have figured out that they can get rich by hijacking supercomputers if they can hide their actions. The new AI system will catch them by comparing program-based graphs, like a fingerprint for software.

The news release states that all programs can be represented as graphs consisting of nodes connected by lines, loops or jumps. Just as one can catch a criminal by comparing his fingerprints (whorls and arcs) with those in a fingerprint database, this new AI system can compare the outlines in a program's control flow graph (note: an abstract representation of a process or program) with a graphical catalog of programs that are allowed to run on a given computer.

The difference is that instead of looking for matches to known criminal programs, the system checks to see if the graphic is among those that identify programs that should be running on the system.

The researchers tested their system by comparing known benign code to abusive bitcoin mining code and found that their system identified illegal mining operations faster and more reliably than conventional non-AI analysis systems.

Because the method relies on graph comparisons, it is not fooled by techniques commonly used by illicit cryptocurrency miners to disguise their code, such as obfuscated variables and comments designed to make the code look like legitimate programming.

While this graph comparison-based approach may not provide a completely foolproof solution for all scenarios, it greatly expands the set of effective methods that cyber detectives can use when curbing cybercrime.

Cryptojacking

The unauthorized use of third-party equipment to mine cryptocurrency is commonly known as cryptojacking, and the target of the hijacking can be a computer, a smartphone, or an entire network of equipment.

On March 31, Singapore-based cybersecurity company Acronis released a cybersecurity survey report showing that 86% of IT professionals are concerned about cryptojacking.

IT experts are increasingly concerned about cryptojacking attacks, according to a survey conducted during World Cyber ​​Protection Week 2020. The study showed that 30% of personal users and 13% of professional users do not know if their data or computer resources have been secretly modified by dangerous means such as cryptojacking.

The report also highlights that awareness and concern about cyber threats such as cryptojacking has grown over the past two years, surging 33% since 2019.

Generally speaking, the frequency and scope of cryptojacking incidents are consistent with the price trend of cryptocurrencies. Recently, the price of cryptocurrencies has been on an upward trend, and cryptojacking incidents have been on the rise again.

On August 20, the lab of cybersecurity company Guardicore released a study saying that a malware called FritzFrog has been deployed to tens of millions of IP addresses. This malware mainly targets government offices, educational institutions, medical centers, banks and telecommunications companies, and installs a Monero (XMR) mining application called XMRig.

In July, Cisco Talos, a security intelligence company under the US technology giant Cisco Systems, pointed out in a report that it had discovered a botnet called "Prometei" that had been active for several months. The network can disable security controls, copy important files, and disguise itself as other programs to perform secret mining operations in computer systems. Since it began operating in early March, researchers estimate that it has infected 1,000 to 5,000 systems.

Cryptojacking remains a widespread problem, and if the artificial intelligence system developed by Los Alamos National Laboratory can indeed more effectively detect illegal crypto mining, it will provide a new and effective solution to curb cryptojacking.