Search All Applications in Cryptocurrency: Security
Application US20200053109
Published 2020-02-13
Cryptojacking Detection
There is disclosed in one example a computing apparatus, including: a processor; and logic encoded into one or more computer-readable mediums, the logic to instruct the processor to: capture first data from an intermediate data source across a first temporal interval; perform partial signal processing on the first data to classify the first temporal interval as either suspicious or not suspicious, wherein the first temporal interval is classified as suspicious if it is determined to potentially represent at least a portion of a cryptomining operation; classify second through N temporal intervals as either suspicious or not suspicious; based on the first through N temporal intervals, classify the apparatus as either operating a cryptomining function or not; and upon classifying the apparatus as operating a cryptomining function and determining that the cryptomining function is not authorized, take remedial action on the apparatus.
Much More than Average Length Specification
View the Patent Matrix® Diagram to Explore the Claim Relationships
USPTO Full Text Publication >
- 1. A computing apparatus, comprising:
a processor; and logic encoded into one or more computer-readable mediums, the logic to instruct the processor to:
capture first data from an intermediate data source across a first temporal interval;
perform partial signal processing on the first data to classify the first temporal interval as either suspicious or not suspicious, wherein the first temporal interval is classified as suspicious if it is determined to potentially represent at least a portion of a cryptomining operation;
classify second through N temporal intervals as either suspicious or not suspicious;
based on the first through N temporal intervals, classify the apparatus as either operating a cryptomining function or not; and
upon classifying the apparatus as operating a cryptomining function and determining that the cryptomining function is not authorized, take remedial action on the apparatus.
- 14. One or more tangible, non-transitory computer-readable storage mediums having stored thereon instructions to:
during first through N temporal intervals, collect data from intermediate data sources; perform partial signal processing on the data of the first through N intervals to individually classify the intervals as either suspicious or not suspicious, wherein an interval is classified as suspicious if it is determined to potentially represent at least a portion of a cryptomining operation; based on the first through N temporal intervals, classify the apparatus as either operating a cryptomining function or not; and upon classifying the apparatus as operating a cryptomining function and determining that the cryptomining function is not authorized, take remedial action on the apparatus.
- 19. A method of detecting a cryptojacking attack on a computing apparatus, comprising:
during first through N temporal intervals, collecting utilization data from one or more data sources; performing partial signal processing on the data of the first through N intervals to individually classify the intervals as either suspicious or not suspicious, wherein an interval is classified as suspicious if it is determined to potentially represent at least a portion of a cryptomining operation; based on the first through N temporal intervals, classifying the apparatus as either operating a cryptomining function or not; and upon classifying the apparatus as operating a cryptomining function and determining that the cryptomining function is not authorized, performing a remedial action for the apparatus.