A data infrastructure for heterogeneous telemetry adaptation: application to Netflow-based cryptojacking detection

• Published in: Annales des télécommunications 2024-04, Vol.79 (3-4), p.241-256
• Main Authors: Moreno-Sancho, Alejandro A., Pastor, Antonio, Martinez-Casanueva, Ignacio D., González-Sánchez, Daniel, Triana, Luis Bellido
• Format: Article
• Language: English
• Subjects: Circuits; Communications Engineering; Communications traffic; Computer Communication Networks; Cryptocurrency mining; Data transmission; Digital currencies; Engineering; Information and Communication; Information sources; Information Systems and Communication Service; Machine learning; Networks; R & D/Technology Policy; Signal,Image and Speech Processing; Supply chains
• ISSN: 0003-4347; 1958-9395
• DOI: 10.1007/s12243-023-00991-6

The increasing development of cryptocurrencies has brought cryptojacking as a new security threat in which attackers steal computing resources for cryptomining. The digitization of the supply chain is a potential major target for cryptojacking due to the large number of different infrastructures involved. These different infrastructures provide information sources that can be useful to detect cryptojacking, but with a wide variety of data formats and encodings. This paper describes the semantic data aggregator (SDA), a normalization and aggregation system based on data modelling and low-latency processing of data streams that facilitates the integration of heterogeneous information sources. As a use case, the paper describes a cryptomining detection system (CDS) based on network traffic flows processed by a machine learning engine. The results show how the SDA is leveraged in this use case to obtain aggregated information that improves the performance of the CDS.