Published March 22, 2023 | Version v1
Conference paper Open

A data infrastructure for heterogeneous telemetry adaptation. Application to Netflow-based cryptojacking detection

  • 1. Atos Research & Innovation
  • 2. Telefonica I+D
  • 3. Universidad Politécnica de Madrid

Description

The increasing development of cryptocurrencies has brought cryptojacking as a new security threat in which attackers steal computing resources for cryptomining. The digitization of the supply chain is a potential major target for cryptojacking due to the large number of different infrastructures involved. These different infrastructures provide information sources that can be useful to detect cryptojacking, but with a wide variety of data formats and encodings. This paper describes the Semantic Data Aggregator (SDA), a normalization and aggregation system based on data modelling and low-latency processing of data streams that facilitates the integration of heterogeneous information sources. As a use case, the paper describes a Cryptomining Detection System (CDS) based on network traffic flows processed by a machine learning engine. The results show how the SDA is leveraged in this use case to obtain aggregated information that improves the performance of the CDS.

Files

A data infrastructure for heterogeneous telemetry adaptation.pdf

Files (543.4 kB)

Additional details

Funding

FISHY – A coordinated framework for cyber resilient supply chain systems over complex ICT infrastructures 952644
European Commission
PALANTIR – Practical Autonomous Cyberhealth for resilient SMEs & Microenterprises 883335
European Commission