Cryptomining makes noise: Detecting cryptojacking via Machine Learning

Maurantonio Caprolu*, Simone Raponi, Gabriele Oligeri, Roberto Di Pietro

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

42 Scopus citations


Cryptojacking occurs when an adversary illicitly runs crypto-mining software over the devices of unaware users. This novel cybersecurity attack, that is emerging in both the literature and in the wild, has proved to be very effective given the simplicity of running a crypto-client into a target device. Several countermeasures have recently been proposed, with different features and performance, but all characterized by a host-based architecture. The cited solutions, designed to protect the individual user, are not suitable for efficiently protecting a corporate network, especially against insiders. In this paper, we propose a network-based approach to detect and identify crypto-clients activities by solely relying on the network traffic, even when encrypted and mixed with non-malicious traces. First, we provide a detailed analysis of the real network traces generated by three major cryptocurrencies, Bitcoin, Monero, and Bytecoin, considering both the normal traffic and the one shaped by a VPN. Then, we propose Crypto-Aegis, a Machine Learning (ML) based framework built over the results of our investigation, aimed at detecting cryptocurrencies related activities, e.g., pool mining, solo mining, and active full nodes. Our solution achieves a striking 0.96 of F1-score and 0.99 of AUC for the ROC, while enjoying a few other properties, such as device and infrastructure independence. Given the extent and novelty of the addressed threat we believe that our approach, supported by its excellent results, pave the way for further research in this area.

Original languageEnglish (US)
Pages (from-to)126-139
Number of pages14
JournalComputer Communications
StatePublished - Apr 1 2021


  • Blockchain
  • Cryptocurrencies
  • Cryptojacking
  • Machine Learning
  • Network traffic analysis
  • Security

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'Cryptomining makes noise: Detecting cryptojacking via Machine Learning'. Together they form a unique fingerprint.

Cite this