基于行为的GPU加密劫持检测
Behavior-Based Detection of GPU Cryptojacking
AI总结：
本文针对日益增多的GPU加密劫持威胁，提出基于应用GPU负载与显卡RAM消耗的复合暴露机制，并设计决策树检测原型，在虚拟机环境中实现80%检测率和20%误报率。
摘要：
随着基于区块链的加密货币激增，非法挖矿已成为流行网络威胁。主机端加密劫持（攻击者秘密利用受害者系统挖矿）日益增多。常规加密劫持已被充分研究，但近期攻击者转向GPU加密劫持，因其高哈希率带来更高利润且检测率更低。此外，GPU加密劫持易通过修改显卡驱动传播。本文探讨GPU加密劫持检测问题。首先，讨论其历史、定义及以往检测技术尝试。其次，提出基于应用GPU负载与显卡RAM消耗的复合暴露机制，可检测浏览器端和主机端加密劫持样本。随后，基于该技术设计决策树检测原型程序。在受控虚拟机环境中测试，对选定GPU加密劫持样本检测成功率达80%，对选定合法高GPU负载应用误报率为20%。
英文摘要：
With the surge in blockchain-based cryptocurrencies, illegal mining for cryptocurrency has become a popular cyberthreat. Host-based cryptojacking, where malicious actors exploit victims systems to mine cryptocurrency without their knowledge, is on the rise. Regular cryptojacking is relatively well-known and well-studied threat, however, recently attackers started switching to GPU cryptojacking, which promises greater profits due to high GPU hash rates and lower detection chance. Additionally, GPU cryptojackers can easily propagate using, for example, modified graphic card drivers. This article considers question of GPU cryptojacking detection. First, we discuss brief history and definition of GPU cryptojacking as well as previous attempts to design a detection technique for such threats. We also propose complex exposure mechanism based on GPU load by an application and graphic card RAM consumption, which can be used to detect both browser-based and host-based cryptojacking samples. Then we design a prototype decision tree detection program based on our technique. It was tested in a controlled virtual machine environment with 80% successful detection rate against selected set of GPU cryptojacking samples and 20% false positive rate against selected number of legitimate GPU-heavy applications.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
