{"id":"https://openalex.org/W4206728311","doi":"https://doi.org/10.1186/s13635-021-00126-1","title":"Detection of illicit cryptomining using network metadata","display_name":"Detection of illicit cryptomining using network metadata","publication_year":2021,"publication_date":"2021-12-04","ids":{"openalex":"https://openalex.org/W4206728311","doi":"https://doi.org/10.1186/s13635-021-00126-1"},"language":"en","primary_location":{"id":"doi:10.1186/s13635-021-00126-1","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13635-021-00126-1","pdf_url":"https://jis-eurasipjournals.springeropen.com/track/pdf/10.1186/s13635-021-00126-1","source":{"id":"https://openalex.org/S4210195102","display_name":"EURASIP Journal on Information Security","issn_l":"2510-523X","issn":["2510-523X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EURASIP Journal on Information Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://jis-eurasipjournals.springeropen.com/track/pdf/10.1186/s13635-021-00126-1","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5051268083","display_name":"Michele C. Russo","orcid":"https://orcid.org/0000-0001-6876-2798"},"institutions":[{"id":"https://openalex.org/I4210129353","display_name":"Huawei Technologies (Germany)","ror":"https://ror.org/038cdme44","country_code":"DE","type":"company","lineage":["https://openalex.org/I2250955327","https://openalex.org/I4210129353"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Michele Russo","raw_affiliation_strings":["Huawei Technologies Duesseldorf GmbH, Munich, Germany"],"raw_orcid":"https://orcid.org/0000-0001-6876-2798","affiliations":[{"raw_affiliation_string":"Huawei Technologies Duesseldorf GmbH, Munich, Germany","institution_ids":["https://openalex.org/I4210129353"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007121882","display_name":"Nedim \u0160rndi\u0107","orcid":null},"institutions":[{"id":"https://openalex.org/I4210129353","display_name":"Huawei Technologies (Germany)","ror":"https://ror.org/038cdme44","country_code":"DE","type":"company","lineage":["https://openalex.org/I2250955327","https://openalex.org/I4210129353"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Nedim \u0160rndi\u0107","raw_affiliation_strings":["Huawei Technologies Duesseldorf GmbH, Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Huawei Technologies Duesseldorf GmbH, Munich, Germany","institution_ids":["https://openalex.org/I4210129353"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5089735573","display_name":"Pavel Laskov","orcid":"https://orcid.org/0000-0002-3212-7167"},"institutions":[{"id":"https://openalex.org/I184656255","display_name":"University of Liechtenstein","ror":"https://ror.org/01qjrx392","country_code":"LI","type":"education","lineage":["https://openalex.org/I184656255"]}],"countries":["LI"],"is_corresponding":false,"raw_author_name":"Pavel Laskov","raw_affiliation_strings":["University of Liechtenstein, Vaduz, Liechtenstein"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Liechtenstein, Vaduz, Liechtenstein","institution_ids":["https://openalex.org/I184656255"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5051268083"],"corresponding_institution_ids":["https://openalex.org/I4210129353"],"apc_list":{"value":660,"currency":"GBP","value_usd":809},"apc_paid":{"value":660,"currency":"GBP","value_usd":809},"fwci":1.3991,"has_fulltext":true,"cited_by_count":11,"citation_normalized_percentile":{"value":0.85441414,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":98},"biblio":{"volume":"2021","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.86998450756073},{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.73683762550354},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.560181200504303},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.5287442207336426},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.5060808062553406},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.5060474276542664},{"id":"https://openalex.org/keywords/cryptocurrency","display_name":"Cryptocurrency","score":0.5017390251159668},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5005238056182861},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.44032543897628784},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.4388885498046875},{"id":"https://openalex.org/keywords/anonymity","display_name":"Anonymity","score":0.4323521852493286},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.4300713837146759},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.4139418601989746},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.36461538076400757},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.15403679013252258},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.12710395455360413}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.86998450756073},{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.73683762550354},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.560181200504303},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5287442207336426},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5060808062553406},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.5060474276542664},{"id":"https://openalex.org/C180706569","wikidata":"https://www.wikidata.org/wiki/Q13479982","display_name":"Cryptocurrency","level":2,"score":0.5017390251159668},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5005238056182861},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.44032543897628784},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.4388885498046875},{"id":"https://openalex.org/C178005623","wikidata":"https://www.wikidata.org/wiki/Q308859","display_name":"Anonymity","level":2,"score":0.4323521852493286},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.4300713837146759},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4139418601989746},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36461538076400757},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.15403679013252258},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.12710395455360413},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s13635-021-00126-1","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13635-021-00126-1","pdf_url":"https://jis-eurasipjournals.springeropen.com/track/pdf/10.1186/s13635-021-00126-1","source":{"id":"https://openalex.org/S4210195102","display_name":"EURASIP Journal on Information Security","issn_l":"2510-523X","issn":["2510-523X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EURASIP Journal on Information Security","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:58a39e89dfcc4878b72917f3919e8eda","is_oa":true,"landing_page_url":"https://doaj.org/article/58a39e89dfcc4878b72917f3919e8eda","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"EURASIP Journal on Information Security, Vol 2021, Iss 1, Pp 1-20 (2021)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s13635-021-00126-1","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13635-021-00126-1","pdf_url":"https://jis-eurasipjournals.springeropen.com/track/pdf/10.1186/s13635-021-00126-1","source":{"id":"https://openalex.org/S4210195102","display_name":"EURASIP Journal on Information Security","issn_l":"2510-523X","issn":["2510-523X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EURASIP Journal on Information Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4206728311.pdf","grobid_xml":"https://content.openalex.org/works/W4206728311.grobid-xml"},"referenced_works_count":56,"referenced_works":["https://openalex.org/W1585105376","https://openalex.org/W1989359075","https://openalex.org/W2026621111","https://openalex.org/W2076758681","https://openalex.org/W2078191206","https://openalex.org/W2096118443","https://openalex.org/W2114718230","https://openalex.org/W2114996745","https://openalex.org/W2118034040","https://openalex.org/W2119271160","https://openalex.org/W2129141174","https://openalex.org/W2134539183","https://openalex.org/W2136053377","https://openalex.org/W2146860726","https://openalex.org/W2147986322","https://openalex.org/W2153056025","https://openalex.org/W2164210932","https://openalex.org/W2295321789","https://openalex.org/W2532292920","https://openalex.org/W2743556905","https://openalex.org/W2763172007","https://openalex.org/W2808649067","https://openalex.org/W2887627765","https://openalex.org/W2887682444","https://openalex.org/W2889222606","https://openalex.org/W2890152369","https://openalex.org/W2890228473","https://openalex.org/W2890978676","https://openalex.org/W2891506146","https://openalex.org/W2891983639","https://openalex.org/W2897385569","https://openalex.org/W2899353874","https://openalex.org/W2903438051","https://openalex.org/W2913857451","https://openalex.org/W2914982603","https://openalex.org/W2919762867","https://openalex.org/W2963603877","https://openalex.org/W2963879194","https://openalex.org/W2969259791","https://openalex.org/W2969540442","https://openalex.org/W2978765985","https://openalex.org/W2980839873","https://openalex.org/W3000503630","https://openalex.org/W3004042723","https://openalex.org/W3081417472","https://openalex.org/W3092096643","https://openalex.org/W3118407372","https://openalex.org/W3120557083","https://openalex.org/W3121642005","https://openalex.org/W3138147846","https://openalex.org/W3213511415","https://openalex.org/W4242127608","https://openalex.org/W6602469948","https://openalex.org/W6608280790","https://openalex.org/W6632993596","https://openalex.org/W6818100936"],"related_works":["https://openalex.org/W2134539183","https://openalex.org/W2359209543","https://openalex.org/W2370801098","https://openalex.org/W3201228709","https://openalex.org/W2380475535","https://openalex.org/W2922354075","https://openalex.org/W2377112249","https://openalex.org/W4320027669","https://openalex.org/W2108086154","https://openalex.org/W4245323162"],"abstract_inverted_index":{"Abstract":[0],"Illicit":[1],"cryptocurrency":[2,27],"mining":[3,53,63,122,164,181],"has":[4],"become":[5],"one":[6],"of":[7,13,31,80,90],"the":[8,29,66,108,151,183],"prevalent":[9],"methods":[10],"for":[11,28],"monetization":[12],"computer":[14],"security":[15],"incidents.":[16],"In":[17],"this":[18,84],"attack,":[19],"victims\u2019":[20],"computing":[21],"resources":[22],"are":[23],"abused":[24],"to":[25,180],"mine":[26],"benefit":[30],"attackers.":[32],"The":[33],"most":[34],"popular":[35],"illicitly":[36],"mined":[37,50],"digital":[38],"coin":[39],"is":[40,48,117,166,178],"Monero":[41],"as":[42,173],"it":[43,159],"provides":[44],"strong":[45],"anonymity":[46],"and":[47,61,124,136,175,177],"efficiently":[49],"on":[51,56,77,106],"CPUs.Illicit":[52],"crucially":[54],"relies":[55],"communication":[57],"between":[58],"compromised":[59],"systems":[60],"remote":[62],"pools":[64],"using":[65,102,120],"de":[67],"facto":[68],"standard":[69],"protocol":[70,110],"Stratum.":[71],"While":[72],"prior":[73],"research":[74],"primarily":[75],"focused":[76],"endpoint-based":[78],"detection":[79,89,143],"in-browser":[81],"mining,":[82],"in":[83,93,182,194,203],"paper,":[85],"we":[86,199],"address":[87],"network-based":[88],"cryptomining":[91],"malware":[92],"general.":[94],"We":[95],"propose":[96],"XMR-Ray,":[97],"a":[98,195],"machine":[99],"learning":[100],"detector":[101,116,193],"novel":[103],"features":[104],"based":[105],"reconstructing":[107],"Stratum":[109],"from":[111],"raw":[112],"NetFlow":[113],"records.":[114],"Our":[115,154],"trained":[118],"offline":[119],"only":[121],"traffic":[123],"does":[125],"not":[126],"require":[127],"privacy-sensitive":[128],"normal":[129],"network":[130],"traffic,":[131],"which":[132],"facilitates":[133],"its":[134,201],"adoption":[135],"integration.In":[137],"our":[138,192],"experiments,":[139],"XMR-Ray":[140],"attained":[141],"98.94%":[142],"rate":[144],"at":[145],"0.05%":[146],"false":[147],"alarm":[148],"rate,":[149],"outperforming":[150],"closest":[152],"competitor.":[153],"evaluation":[155],"furthermore":[156],"demonstrates":[157],"that":[158],"reliably":[160],"detects":[161],"previously":[162],"unseen":[163],"pools,":[165],"robust":[167],"against":[168],"common":[169],"obfuscation":[170],"techniques":[171],"such":[172],"encryption":[174],"proxies,":[176],"applicable":[179],"browser":[184],"or":[185],"by":[186,190],"compiled":[187],"binaries.":[188],"Finally,":[189],"deploying":[191],"large":[196],"university":[197],"network,":[198],"show":[200],"effectiveness":[202],"protecting":[204],"real-world":[205],"systems.":[206]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":3}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}