Cybercriminals have been exploiting cryptocurrencies to commit various unique
financial frauds. Covert cryptomining - which is defined as an unauthorized
harnessing of victims' computational resources to mine cryptocurrencies - is
one of the prevalent ways nowadays used by cybercriminals to earn financial
benefits. Such exploitation of resources causes financial losses to the
victims.
In this paper, we present our novel and efficient approach to detect covert
cryptomining. Our solution is a generic solution that, unlike currently
available solutions to detect covert cryptomining, is not tailored to a
specific cryptocurrency or a particular form of cryptomining. In particular, we
focus on the core mining algorithms and utilize Hardware Performance Counters
(HPC) to create clean signatures that grasp the execution pattern of these
algorithms on a processor. We built a complete implementation of our solution
employing advanced machine learning techniques. We evaluated our methodology on
two different processors through an exhaustive set of experiments. In our
experiments, we considered all the cryptocurrencies mined by the top-10 mining
pools, which collectively represent the largest share (84% during Q3 2018) of
the cryptomining market. Our results show that our classifier can achieve a
near-perfect classification with samples of length as low as five seconds. Due
to its robust and practical design, our solution can even adapt to zero-day
cryptocurrencies. Finally, we believe our solution is scalable and can be
deployed to tackle the uprising problem of covert cryptomining.