CryptojackingTrap: An Evasion Resilient Nature-Inspired Algorithm to Detect Cryptojacking Malware

• Published in: IEEE transactions on information forensics and security 2024, Vol.19, p.7465-7477
• Main Authors: Zareh Chahoki, Atefeh, Shahriari, Hamid Reza, Roveri, Marco
• Format: Article
• Language: English
• Subjects: Behavioral sciences; Bitcoin; Blockchain; blockchain security; Blockchains; Botcoin; Botnet; Codes; Crypto jacking; cryptocurrency; dynamic analysis; dynamic binary instrumentation; Ethereum; Feature extraction; Malware; malware detection; mining; Monero
• ISSN: 1556-6013; 1556-6021
• DOI: 10.1109/TIFS.2024.3353072

The high profitability of mining cryptocurrencies mining, a computationally intensive activity, forms a fertile ecosystem that is enticing not only legitimate investors but also cyber attackers who invest their illicit computational resources in this area. Cryptojacking refers to the surreptitious exploitation of a victim's computing resources to mine cryptocurrencies on behalf of the cyber-criminal. This malicious behavior is observed in executable files and browser executable codes, including JavaScript and Assembly modules, downloaded from websites to victims' machines and executed. Although there are numerous botnet detection techniques to stop this malicious activity, attackers can circumvent these protections using a variety of techniques. In this paper, CryptojackingTrap is presented as a novel cryptojacking detection solution designed to resist most malware defense methods. The CryptojackingTrap is armed with a debugger and extensible cryptocurrency listeners and its algorithm is based on the execution of cryptocurrency hash functions: an indispensable behavior of all cryptojacking executors. This algorithm becomes aware of this specific hash execution by correlating the memory access traces of suspicious executables with publicly available cryptocurrency P2P network data. With the advantage of this assembly-level investigation and a nature-inspired approach to triggering the detection alarm, CryptojackingTrap provides an accurate, evasion-proof technique for detecting cryptojacking. After experimental evaluation, the false negative and false positive rates are zero, and in addition, the false positive rate is mathematically calculated as 10−20. CryptojackingTrap has an open, extensible architecture and is available to the open-source community.