一句话：提出 MinerRay，通过推断 WebAssembly/JavaScript 中挖矿行为本质并检查用户操作实例化，检测恶意浏览器内加密挖矿。
浏览器内加密挖矿已成为可行的融资模式，但也被滥用为大规模 cryptojacking，在用户浏览器中秘密挖矿。现有基于签名或运行时特征的方法往往不精确且容易被规避。本文提出 MinerRay，一种检测恶意浏览器内加密挖矿的通用方案。MinerRay 不依赖不可靠的外部模式，而是推断加密挖矿行为的本质，从而在 WebAssembly 和 JavaScript 两种上下文中将挖矿与常见浏览器活动区分开来。为发现未经用户同意的隐蔽挖矿，MinerRay 还检查矿工是否只能由用户操作实例化。摘要未报告具体实验结果或评估细节。
Recent advances in web technology have made in-browser cryptomining a viable funding model. However, these services have been abused to launch large-scale cryptojacking attacks to secretly mine cryptocurrency in browsers. To detect them, various signature-based or runtime feature-based methods have been proposed. However, they can be imprecise or easily circumvented. To this end, we propose MinerRay, a generic scheme to detect malicious in-browser cryptominers. Instead of leveraging unreliable external patterns, MinerRay infers the essence of cryptomining behaviors that differentiate mining from common browser activities in both WebAssembly and JavaScript contexts. Additionally, to detect stealthy mining activities without user consents, MinerRay checks if the miner can only be instantiated from user actions.
DOI 原文 ·
@inproceedings{paperbot5937,
title = {MinerRay},
author = {Alan Romano and Yunhui Zheng and Weihang Wang},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3416580}
}