118, application server (AS) 104 and/or database (DB) 106, other components of core network 102, devices reachable via the Internet in general, and so forth. In one example, each of the devices 110, 112, and 114 may comprise any single device or combination of devices that may comprise a user endpoint device. For example, the devices 110, 112, and 114 may each comprise a mobile device, a cellular smart phone, a laptop, a tablet computer, a desktop computer, an application server, a bank or cluster of such devices, and the like. In one example, any one or more of devices 110, 112, and 114 may each comprise programs, logic or instructions for generating an unauthorized cryptomining alert as described herein. For example, devices 110, 112, and/or 114 may each comprise a computing system or device, such as computing system 300 depicted in FIG. 3, and may be configured to provide one or more operations or functions for generating an unauthorized cryptomining alert.

It should be noted that as used herein, the terms “configure,” and “reconfigure” may refer to programming or loading a processing system with computer-readable/computer-executable instructions, code, and/or programs, e.g., in a distributed or non-distributed memory, which when executed by a processor, or processors, of the processing system within a same device or within distributed devices, may cause the processing system to perform various functions. Such terms may also encompass providing variables, data values, tables, objects, or other data structures or the like which may cause a processing system executing computer-readable instructions, code, and/or programs to function differently depending upon the values of the variables or other data structures that are provided. As referred to herein a “processing system” may comprise a computing device including one or more processors, or cores (e.g., as illustrated in FIG. 3 and discussed below) or multiple computing devices collectively configured to perform various steps, functions, and/or operations in accordance with the present disclosure.

To illustrate, device 110 may comprise an enterprise server with significant computing resources for providing various computing services to a large organization, e.g., a national bank, a hospital network, a university, etc. Accordingly, device 110 may comprise a high value target for a bad actor intent upon exploiting the computing resources of device 110 for unauthorized cryptomining. For instance, the bad actor may utilize device 114 to initiate an attack on device 110 over one or more networks and may gain access to device 110 to install and run an unauthorized cryptomining application (e.g., as one or more running processes). It should be noted that the unauthorized cryptomining application may be configured to attempt to hide the presence of the unauthorized cryptomining application and its activities from device 110 and/or an operator thereof using any one or more techniques for evading detection by antivirus software, or the like. For instance, the unauthorized cryptomining application may attempt to run as one or more hidden processes, may install itself in file locations and may utilize file names and extensions that may attempt to appear as ordinary files and/or as other legitimate files, and so forth. Alternatively, or in addition, the unauthorized cryptomining application may comprise a publicly available application that may be used for legitimate purposes in other circumstances, but which are simply installed and operating on device 110 without proper authorization.

In any case, the unauthorized cryptomining application may instantiate processes to engage in cryptomining operations which may result in significant electricity usage and cost, increased device heat, and increased processor and memory utilizations. In one example, unauthorized cryptomining may involve commands from a remote server to initiate the unauthorized cryptomining. Thus, for example, there may be network traffic between device 110 and device 114. Initially, the network traffic may involve a key exchange followed by device 114 loading device 110 with instructions and other information relating to a cryptographic puzzle (e.g., a hash puzzle) to be solved. Thereafter, the unauthorized cryptomining application (e.g., the one or more running processes and/or threads thereof) may cause significant processor and memory resources to be occupied for an extended period of time (e.g., at least five minutes, at least 10 minutes, at least 30 minutes, or more than one hour) while solving the cryptographic puzzle(s). In one example, the unauthorized cryptomining application operating on device 110 may be controlled by device 114 to solve multiple cryptographic puzzles, e.g., back-to-back or in parallel via different CPUs/cores, different GPUs, different sets of memory resources, etc. Following, the completion of task relating to solving one or more cryptographic puzzles, the unauthorized cryptomining application may need to upload the results to device 114. In one example, the unauthorized cryptomining application may store multiple results and may offload the results at a later time. For instance, this may comprise an attempt to avoid detection. In another example, the unauthorized cryptomining application may await a query or instruction from device 114 in response to which the results may be transmitted to device 114.

In accordance with the present disclosure, the unauthorized cryptomining may generate a specific pattern that may be recognized by an unauthorized cryptomining detection service running on device 110. For instance, the pattern many comprise: a first network utilization burst, a processor utilization exceeding a processor utilization threshold and a memory utilization exceeding a memory utilization threshold over at least a designated period of time following the first network utilization burst, and a second network utilization burst after at least the designated period of time. In one example, since unauthorized cryptomining is generally associated with elevated device heat levels, the device 110 may initially monitor for the device temperature exceeding a threshold, upon which the unauthorized cryptomining detection service may be activated to perform pattern detection. For example, the unauthorized cryptomining detection service may obtain utilization information of the device comprising: processor utilization information, memory utilization information, and network utilization information, and may detect the pattern comprising the first network utilization burst, the processor utilization exceeding a processor utilization threshold and the memory utilization exceeding a memory utilization threshold over at least a designated period of time following the first network utilization burst, and the second network utilization burst after at least the designated period of time.

In one example, the unauthorized cryptomining detection service may detect the pattern and generate the alert based upon overall device utilization metrics. Alternatively, or in addition, the unauthorized cryptomining detection service may detect the pattern and generate the alert with respect to utilization metrics of a particular process, or a set of processes and/or threads. In one example, the unauthorized cryptomining detection service may perform a two-layered process to detect a first pattern with regard to the overall device utilization metrics, and to detect a second pattern with regard to a particular process from among a plurality of running and/or active processes of the device. In one example, the pattern detection may be followed with confirmation via low-level inspection prior to generating an alert. The low-level inspection may comprise determining whether the processor resources of the device are performing any process on distributed ledger data, such as a blockchain string, determining a number of hashing operations of the process exceeds a threshold number of hashing operations within the designated time period, detecting that the process attempts to reserve excess processor and/or memory resources exclusively for itself, verifying that the first network utilization burst comprises a key exchange with a remote device, and so forth.

The alert may be presented audibly or visually via device 110. Alternatively, or in addition, the alert may be sent to one or more other devices, such as device 112. For instance, device 112 may be associated with a network administrator responsible for device 110.

In one example, the unauthorized cryptomining detection service operating on device 110 may include a machine learning (ML) component that may learn different resource consumption patterns for different device loads (e.g., different numbers of running processes, various combinations of running processes, number of concurrent logged in users, etc.) and for different time periods. As such, device 110 may set the various thresholds, and the pattern may be based upon the typical resource consumption patterns. For instance, typical processor utilizations and/or ranges of processor utilizations, and typical memory utilizations and/or ranges of memory utilizations for different numbers of running processes, different combinations of running processes, different times of the day, days of the week, etc. may be learned by the device 110 such that thresholds comprising certain percentage deviations from such values or ranges of values may be implemented to detect a pattern indicative of unauthorized cryptomining on device 110.

Alternatively, or in addition, unauthorized cryptomining detection service operating on device 110 may communicate with a network-based processing system, e.g., comprising server 116 and DB 118 and/or AS 104 and DB 106, which may collect utilization information of various devices and of various device types to develop patterns for detecting unauthorized cryptomining on the respective devices and/or device types. For example, thresholds for detecting a pattern indicative of unauthorized cryptomining on a first device type may be based upon utilization information obtained from a plurality of devices of the first device type, whereas thresholds for detecting a pattern indicative of unauthorized cryptomining on a second device type may be based upon utilization information obtained from a plurality of devices of the second device type.

In this regard, the access networks 122 may also be in communication with a server 116 and a database (DB) 118. In accordance with the present disclosure, server 116 may comprise a computing system or server, such as computing system 300 depicted in FIG. 3, and may be configured to provide one or more operations or functions for generating an unauthorized cryptomining alert, as described herein. In one example, DB 118 may comprise a physical storage device integrated with server 116 (e.g., a database server), or attached or coupled to the server 116, to store various types of information in support of systems for generating an unauthorized cryptomining alert, in accordance with the present disclosure. For example, DB 118 may store executables and/or code signatures of known cryptomining applications/processes (e.g., miner executable). In addition, DB 118 may store patterns for detecting unauthorized cryptomining from device utilization information (e.g., heat thresholds, processor and/or memory utilization thresholds, network utilization timing thresholds, and so forth).

In one example, the patterns may be specific to particular devices or device types. For instance, one type of personal computer may generally run hotter than another type of personal computer. As such, the temperature thresholds may be different for these different device types. Similarly, in one example the typical usage of one device of the same type may different from another. For instance, two users may have a same laptop computer. However, one of the users may primarily use his or her laptop computer on the lap, which may block one or more cooling fans, while the other user may primarily use his or her laptop on a table, which may not have the same type of obstruction. In one example, server 116 may monitor various devices of one or more device types to learn over time these various patterns and to set the respective thresholds for detecting excessive heat, for detecting the pattern that is indicative of unauthorized cryptomining, and so forth.

In one example, the typical (e.g., average or median) utilization metrics for specific devices may be compiled by the server 116 and stored in DB 118, such as the average device heat, the average CPU utilization, the average memory utilization, the average NIC utilization, etc. For instance, devices, such as devices 110, 112, 114, etc. may report utilization metrics to server 116. These typical utilization metrics may also be stored arranged by date and time (e.g., weekdays, weekends, morning, afternoon, evening, overnight, etc., particular hours, holidays, and so forth). In one example, server 116 may include a machine learning (ML) component (e.g., an ML module) that may learn different resource consumption patterns for different device loads (e.g., different numbers of running processes, various combinations of running processes, number of concurrent logged in users, etc.) and for different time periods.

In one example, server 116 may process requests from various devices, such as devices 110, 112, and/or 114, for patterns indicative of unauthorized cryptomining (e.g., patterns that are specific to the respective devices and/or device types), for executables and/or code signatures of known cryptomining applications/processes, and so forth. In one example, DB 118 may also store programs, logic, or instructions that may be executed by server 116 for processing such requests. For instance, server 116 and DB 118 may comprise part of a system for generating an unauthorized cryptomining alert, and may alternatively or additionally provide a service to subscribing devices in connection with detecting and generating alerts for unauthorized cryptomining, in accordance with the present disclosure.

In addition, in one example, server 116 may perform operations of the method 200 of FIG. 2 to detect and generate alerts for unauthorized cryptomining which may be taking place on server 116. In other words, server 116 may itself become compromised and may be coopted into performing unauthorized cryptomining, which may be detected via the techniques described herein.

Although only a single server 116 and a single DB 118 are illustrated, it should be noted that any number of servers 116 or databases 118 may be deployed. In one example, core network 102 may also include an application server (AS) 104 and a database (DB) 106. In one example, AS 104 may perform the same or similar functions as server 116. Similarly, DB 106 may store the same or similar information as DB 118 (e.g., patterns indicative of unauthorized cryptomining, executables and/or code signatures of known cryptomining applications/processes, etc., programs, logic, or instructions that may be executed by AS 104 and/or server 116 for generating an unauthorized cryptomining alert, and so forth). For instance, core network 102 may provide a service to subscribing devices in connection with detecting and generating alerts for unauthorized cryptomining, e.g., in addition to television, phone, and/or other telecommunication services. In one example, AS 104, DB 106, server 116, and/or DB 118, or any one or more of such devices in conjunction with one or more of devices 110, 112, and/or 114, may operate in a distributed and/or coordinated manner to perform various steps, functions, and/or operations described herein.

It should be noted that the system 100 has been simplified. Thus, the system 100 may be implemented in a different form than that which is illustrated in FIG. 1, or may be expanded by including additional endpoint devices, access networks, network elements, application servers, etc. without altering the scope of the present disclosure. In addition, system 100 may be altered to omit various elements, substitute elements for devices that perform the same or similar functions, combine elements that are illustrated as separate devices, and/or implement network elements as functions that are spread across several devices that operate collectively as the respective network elements. For example, the system 100 may include other network elements (not shown) such as border elements, routers, switches, policy servers, security devices, gateways, a content distribution network (CDN) and the like. For example, portions of core network 102 and/or access networks 120 and 122 may comprise a content distribution network (CDN) having ingest servers, edge servers, and the like, for packet-based streaming of videos or video segments that may be provided in accordance with the present disclosure. Similarly, although only two access networks 120 and 122 are shown, in other examples, access networks 120 and/or 122 may each comprise a plurality of different access networks that may interface with core network 102 independently or in a chained manner. For example, device 114 and server 116 may access core network 102 via different access networks, devices 110 and 112 may access core network 102 via different access networks, and so forth. Thus, these and other modifications are all contemplated within the scope of the present disclosure.

FIG. 2 illustrates a flowchart of an example method 200 for generating an unauthorized cryptomining alert, in accordance with the present disclosure. In one example, the method 200 is performed by a component of the system 100 of FIG. 1, such as by one of devices 110, 112, or 114, the server 116, or application server 104, and/or any one or more components thereof (e.g., a processor, or processors, performing operations stored in and loaded from a memory), by a plurality of the devices 110, 112, or 114, server 116, or application server 104, or by any one or more of such devices in conjunction with one or more other devices, such as DB 106, DB 118, and so forth. In one example, the steps, functions, or operations of method 200 may be performed by a computing device or system 300, and/or processor 302 as described in connection with FIG. 3 below. For instance, the computing device or system 300 may represent any one or more components of a device, server, and/or application server in FIG. 1 that is/are configured to perform the steps, functions and/or operations of the method 200. Similarly, in one example, the steps, functions, or operations of method 200 may be performed by a processing system comprising one or more computing devices collectively configured to perform various steps, functions, and/or operations of the method 200. For instance, multiple instances of the computing device or processing system 300 may collectively function as a processing system. For illustrative purposes, the method 200 is described in greater detail below in connection with an example performed by a processing system. The method 200 begins in step 205 and proceeds to step 210.

At step 210, the processing system (e.g., of a device deployed in and/or receiving a communication service from a communication network) determines that a temperature of the device exceeds a threshold temperature. In one example, the threshold temperature is set based upon historical temperature measurements of the device over a period of time. In one example, the threshold temperature may be set based upon historical temperature measurements of a plurality of devices of a same device type as the device over a period of time. In addition, in one example, the threshold temperature may be set in accordance with an ambient temperature around the device. For instance, step 210 may measure the difference between the device temperature and the surrounding temperature, and the threshold may similarly correspond to such a difference in temperatures. In one example, step 210 may comprise monitoring the temperature of the device during an after-hours time period of the device, where the after-hours time period is defined by an operator of the device.

At optional step 220, the processing system may determine that an electricity utilization of the device is in excess of an electricity utilization threshold. In one example, the electricity utilization threshold may be set based upon historical electricity measurements of the device over a period of time. In one example, the electricity utilization threshold may be set based upon historical electricity measurements of a plurality of devices of a same device type as the device over a period of time. In one example, optional step 220 may be performed during an after-hours time period (e.g., following step 210 and/or in conjunction with step 210).

At step 230, the processing system obtains utilization information of the device comprising: processor utilization information, memory utilization information, and network utilization information. In one example, the obtaining of the utilization information of the device may be performed in response to the determining that the temperature of the device exceeds the threshold temperature at step 210. In one example, step 230 may also be performed in response to determining that the electricity utilization of the device is in excess of the electricity utilization threshold at optional step 220.

At optional step 240, the processing system may determine, from the processor utilization information and the memory utilization information, that an overall processor utilization of the device is in excess of an overall processor utilization threshold, and that an overall memory utilization of the device is in excess of an overall memory utilization threshold. For instance, optional step 240 may comprise a first-stage screening via which the processing system may determine whether further investigation of possible unauthorized cryptomining should be pursued. In one example, the overall processor utilization threshold and the overall memory utilization threshold are determined in accordance with a machine learning model that is trained over historical utilization information of the device. In one example, the machine learning model may be further trained over historical utilization information of a plurality of devices of a same device type as the device.

At step 250, the processing system detects from the utilization information of the device a pattern comprising: a first network utilization burst, a processor utilization exceeding a processor utilization threshold and a memory utilization exceeding a memory utilization threshold over at least a designated period of time following the first network utilization burst, and a second network utilization burst after at least the designated period of time. In one example, step 250 may be performed in response to determining at optional step 240 that the overall processor utilization of the device is in excess of the overall processor utilization threshold and that the overall memory utilization of the device is in excess of the overall memory utilization threshold.