Nypto

Cryptojacking detection through pure network monitoring.

Nypto is a network monitoring solution that detects cryptomining activities that may or not be hidden on the local machines. It is intented to be running in strategic places (Linux appliances on access switches mirroring ports as depicted in the example architecture on the side) and its impact on the network is negligible.

Feel free to contribute by leaving your pull requests!

Models

Nypto is divided in two models:

• 🔸 Offline model (master branch): this model is heavily optimized to work on the given datasets and it is not prepared to work on a live scenario, when packets are captured and classified on the go. However, it has a wider range on scenarios, which particularly included traffic mixes of different classes, making the classification results less precise.
• 🔹 Live-filtering model (live-filtering branch): this model is simpler than the previous one, not including any type of mixed classes, and is prepared for live capturing and classification of packets.

Datasets

Many traces of various traffic classes were obtained to make this models realistic in today's internet reality:

• YouTube 🔸🔹
• Netflix 🔸🔹
• Browsing 🔸🔹
• Social Networking 🔸🔹
• Email 🔸🔹
• VPN tunneling (Netflix, YouTube, CPU Mining 2&4 threads) 🔸🔹
• CPU Mining (2&4 threads mining Neoscrypt) 🔸🔹
• GPU Mining (EquiHash - 60% usage on GTX 1070 and 85%-100% on GTX 1080Ti) 🔸🔹
• Normal traffic mixes 🔸
  • Browsing & Netflix 🔸
  • Browsing & Social Networking 🔸
  • Browsing & Youtube 🔸
  • Netflix & Social Networking 🔸
  • Netflix & YouTube 🔸
  • Social Networking & YouTube 🔸
• Mining traffic mixes 🔸
  • CPU Mining (2&4 threads mining Neoscrypt) & Browsing
  • CPU Mining (2&4 threads mining Neoscrypt) & Netflix
  • CPU Mining (2&4 threads mining Neoscrypt) & Social Networking
  • CPU Mining (2&4 threads mining Neoscrypt) & YouTube
  • GPU Mining (EquiHash - 60% usage on GTX 1070 and 85% and 100% on GTX 1080Ti) & Browsing 🔸
  • GPU Mining (EquiHash - 60% usage on GTX 1070 and 85% and 100% on GTX 1080Ti) & Netflix 🔸
  • GPU Mining (EquiHash - 60% usage on GTX 1070 and 85% and 100% on GTX 1080Ti) & Social Networking 🔸
  • GPU Mining (EquiHash - 60% usage on GTX 1070 and 85% and 100% on GTX 1080Ti) & YouTube 🔸

In order to download the original used traces, please use the following link.

Files

• parse_packets.py: Obtains packet counts (number of download/upload bytes and packets) from Wireshark captures and writes them to a text file;
• generate_merge_datasets.py: Generates new dataset, resultant from the merge of a set of given datasets;
• scalogram.py: Returns Scalograms/Wavelets features from a given time window;
• profiling.py: Breaks the datasets into multiple windows (sliding windows), obtains its features and returns a single NumPy matriz for each type of feature, which includes all datasets;
• classification.py: Classifies windows using machine learning algorithms and shows the user those results;
• filtering.py: Live capture and filtering of traffic, using the models created by classification.py.

Profiling

Each window has a set of features that were extracted:

• Upload/download packet and bytes count average;
• Upload/download packet and bytes count median;
• Upload/download packet and bytes count standard deviation;
• Upload/download packet and bytes count 75, 90 and 95 percentils;
• Upload/download packet and bytes silent periods average;
• Upload/download packet and bytes silent periods variance;
• Upload/download packet and bytes scalograms (scales 2 and 4).

These features are also normalized and processed by PCA.

Classification

"Offline" model

Classification techniques	Nº Classes	Window size (slide)	Window Aggr. (threshold)	True positives	False negatives	False positives	True negatives	Precision	Recall	Accuracy
SVM SVC (global model)	39	2 min (20 s)	1	1201	1455	704	11469	0.6304	0.4522	0.8544
SVM SVC (global model)	39	2 min (20 s)	40 (0.55)	1269	1452	636	11472	0.6661	0.4664	0.8592
SVM SVC (global model)	39	6 min (20 s)	40 (0.60)	1189	845	624	11863	0.6558	0.5846	0.8988
Random forests (global model) / SVM SVC (silence model)	31	6 min (20 s)	40 (0.60)	1702	1121	111	10422	0.9388	0.6029	0.9078

Live filtering model

Classification techniques	Nº Classes	Window size (slide)	Window Aggr. (threshold)	True positives	False negatives	False positives	True negatives	Precision	Recall	Accuracy
SVM Linear SVC (binary classsification)	2	2 min (20 s)	50 (0.55)	714	98	297	9704	0.7062	0.8793	0.9635
SVM SVC (global model)	13	6 min (20 s)	70 (0.55)	967	127	0	9619	1.0	0.8839	0.9881

Binary classification Confusion Matrix

    0       1
0 714.0   297.0 
1  98.0  9704.0

13 classes Confusion Matrix

        0     1     2     3     4     5     6     7     8     9    10    11    12    13 
  0 140.0   1.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0 
  1   0.0 159.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0 
  2   0.0   2.0 106.0  56.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0 
  3   0.0   0.0   0.0 135.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0 
  4   0.0   0.0   0.0  10.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0 
  5   0.0   0.0   0.0  21.0   0.0 145.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0 
  6   0.0   0.0   0.0   0.0   0.0 160.0  32.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0 
  7   0.0   0.0   0.0   0.0   0.0  32.0   0.0  40.0  97.0   0.0   0.0   6.0   0.0   0.0 
  8   0.0   0.0   0.0   0.0   0.0   0.0   0.0  39.0  64.0   0.0   2.0   0.0  39.0   1.0 
  9   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   2.0   0.0   0.0 935.0   5.0   0.0 
 10   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0 1970.0   0.0   0.0 
 11   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0   0.0  11.0   0.0 6129.0   0.0   2.0 
 12   0.0   0.0   0.0   0.0   0.0  31.0  54.0  38.0   0.0   0.0   0.0  59.0   0.0   7.0 
 13   0.0   0.0   0.0   0.0   0.0   0.0  10.0   5.0   0.0   1.0   0.0 167.0   0.0   0.0 

Diogo Ferreira & Pedro Martins - 2018