基于网络流量的挖矿币种识别方法研究

doi:10.3778/j.issn.1002-8331.2404-0049

摘要/Abstract

摘要： 针对当前挖矿币种识别数据集匮乏以及币种识别方法单一问题，基于挖矿网络流量构建了一套挖矿币种识别数据集MCID，包含5种虚拟货币挖矿币种的14 348条样本。同时将币种识别定义为文本分类任务，结合文本特征向量与机器学习方法进行币种分类的基线模型实验。在此基础上，以决策树为基学习器，构建多层次Bagging分类模型。实验结果显示，结合文本特征向量与机器学习的基线模型在MCID上取得了显著效果，尤其是N-Gram+多层感知器模型，准确率和F1值分别达到97.14%和96.95%。多层次Bagging分类模型的表现优于所有基线模型，其准确率和F1值分别达到了97.49%和97.32%。不仅填补了币种识别数据集的研究空白，还提供了币种分类的基线模型，并在其基础上构建了多层次Bagging分类模型，为虚拟货币挖矿币种识别方法的选择提供了指导。此外，该研究的结论也可为未来虚拟货币挖矿场景模拟、金融安全和节能减排等业务的结合提供参考依据。MCID已在GitHub上公开发布，详细地址如下：https：//github.com/jialongguo/MCID。

关键词: 虚拟货币, 挖矿, 网络流量, 币种识别, 机器学习

Abstract: In response to the scarcity of mineable cryptocurrency identification datasets and the limited methods for cryptocurrency recognition, this paper has established a mineable cryptocurrency identification dataset (MCID) based on mining network traffic, comprising 14 348 samples from five different virtual currencies. The task of cryptocurrency identification is defined as a text classification problem, where baseline models are experimented with combining text feature vectors and machine learning techniques for currency classification. Using decision trees as base learners, a multi-level Bagging classification model is constructed. Experimental results demonstrate that the baseline model combining text feature vectors and machine learning achieves significant performance on MCID, especially the N-Gram + multilayer perceptron model, with accuracy and F1 score reaching 97.14% and 96.95%, respectively. The performance of the multi-level Bagging classification model surpasses all baseline models, achieving accuracy and F1 score of 97.49% and 97.32%, respectively. This research not only fills the gap in cryptocurrency identification datasets but also provides baseline models for currency classification, along with the development of a multi-level Bagging classification model. These findings offer guidance for selecting methods in mining cryptocurrency identification. Additionally, the conclusions of this study can serve as a reference for integrating virtual currency mining scenarios with financial security and energy conservation initiatives in the future. MCID has been publicly released on GitHub, and the detailed address is provided below: https://github.com/jialongguo/MCID.

Key words: cryptocurrency, mining, network traffic, cryptocurrency identification, machine learning

彭晏飞, 郭家隆, 黄瑾, 郑宏威, 王庚哲. 基于网络流量的挖矿币种识别方法研究[J]. 计算机工程与应用, 2025, 61(13): 200-207.

PENG Yanfei, GUO Jialong, HUANG Jin, ZHENG Hongwei, WANG Gengzhe. Methods for Mineable Cryptocurrency Identification Based on Network Traffic[J]. Computer Engineering and Applications, 2025, 61(13): 200-207.

参考文献

[1] 史博轩, 林绅文, 毛洪亮. 基于网络流量的挖矿行为检测识别技术研究[J]. 计算机应用研究, 2022, 39(7): 1956-1960.
SHI B X, LIN S W, MAO H L. Research on mining behavior detection and identification technology based on network traffic[J]. Application Research of Computers, 2022, 39(7): 1956-1960.
[2] 董希淼. 加强虚拟货币的整治与监管[J]. 中国金融, 2021(11): 82-83.
DONG X M. Strengthen the rectification and supervision of virtual currency[J]. China Finance, 2021(11): 82-83.
[3] 周婧莹, 黎宇, 黄坤, 等. 基于DNS流量分析识别加密货币矿工的研究和实现[J]. 邮电设计技术, 2023(8): 48-52.
ZHOU J Y, LI Y, HUANG K, et al. Research and implementation of cryptocurrency miner detection based on DNS traffic analysis[J]. Designing Techniques of Posts and Telecommunications, 2023(8): 48-52.
[4] 高见, 孙懿, 王润正, 等. 基于机器学习的浏览器挖矿检测模型研究[J]. 计算机工程与应用, 2021, 57(22): 125-130.
GAO J, SUN Y, WANG R Z, et al. Research on mining detection model of browser based on machine learning[J]. Computer Engineering and Applications, 2021, 57(22): 125-130.
[5] 黄子依, 秦玉海. 基于多特征识别的恶意挖矿网页检测及其取证研究[J]. 信息网络安全, 2021, 21(7): 87-94.
HUANG Z Y, QIN Y H. Malicious mining web page detection and forensics based on multi-feature recognition[J]. Netinfo Security, 2021, 21(7): 87-94.
[6] RAMESH G, KRISHNAMURTHI I, KUMAR K S S. An efficacious method for detecting phishing webpages through target domain identification[J]. Decision Support Systems, 2014, 61: 12-22.
[7] ZHANG Y, HONG J I, CRANOR L F. Cantina: a content-based approach to detecting phishing web sites[C]//Proceedings of the 16th International Conference on World Wide Web. New York: ACM, 2007: 639-648.
[8] KHONJI M, IRAQI Y, JONES A. Phishing detection: a literature survey[J]. IEEE Communications Surveys & Tutorials, 2013, 15(4): 2091-2121.
[9] SOMMER R, PAXSON V. Outside the closed world: on using machine learning for network intrusion detection[C]//Proceedings of the 2010 IEEE Symposium on Security and Privacy. Piscataway: IEEE, 2010: 305-316.
[10] RAUCHBERGER J, SCHRITTWIESER S, DAM T, et al. The other side of the coin: a framework for detecting and analyzing web-based cryptocurrency mining campaigns[C]//Proceedings of the 13th International Conference on Availability, Reliability and Security. New York: ACM, 2018: 1-10.
[11] 蒋万胜, 朱晓兰. 数字货币的能源消耗及其经济效益的比较性研究[J]. 西安财经大学学报, 2023, 36(1): 3-13.
JIANG W S, ZHU X L. Comparative analysis of the energy consumption and the economic benefits of digital research[J]. Journal of Xi’an University of Finance and Economics, 2023, 36(1): 3-13.
[12] 张宗刚, 支纯. 防范虚拟货币“挖矿” 业务风险[J]. 中国外汇, 2021(11): 68-69.
ZHANG Z G, ZHI C. Guard against the business risk of virtual currency “mining” [J]. China Forex, 2021(11): 68-69.
[13] 林虹萍. 与加密货币相关的网络信息安全风险及技术防范[J]. 警察技术, 2019(6): 49-52.
LIN H P. Network information security risks related to cryptocurrency and its technical prevention[J]. Police Technology, 2019(6): 49-52.
[14] 辛毅, 高泽霖, 黄伟强. 挖矿木马的检测与防护技术分析[J]. 网络空间安全, 2022, 13(1): 41-46.
XIN Y, GAO Z L, HUANG W Q. Detection and protection technological analysis of crypto-mining Trojan[J]. Cyberspace Security, 2022, 13(1): 41-46.
[15] MURAINA I. Ideal dataset splitting ratios in machine learning algorithms: general concerns for data scientists and data analysts[C]//Proceedings of the 7th International Mardin Artuklu Scientific Research Conference, 2022: 496-504.
[16] KOWSARI K, JAFARI MEIMANDI K, HEIDARYSAFA M, et al. Text classification algorithms: a survey[J]. Information, 2019, 10(4): 150.
[17] 李航. 统计学习方法[M]. 北京: 清华大学出版社, 2012.
LI H. Statistical learning method[M]. Beijing: Tsinghua University Press, 2012.
[18] 周志华. 机器学习[M]. 北京: 清华大学出版社, 2016.
ZHOU Z H. Machine learning[M]. Beijing: Tsinghua University Press, 2016.
[19] DAS K, BEHERA R N. A survey on machine learning: concept, algorithms and applications[J]. International Journal of Innovative Research in Computer and Communication Engineering, 2017, 5(2): 1301-1309.
[20] 于治平, 刘彩霞, 刘树新, 等. 基于机器学习的网络流量分类综述[J]. 信息工程大学学报, 2023, 24(4): 447-453.
YU Z P, LIU C X, LIU S X, et al. Overview of network traffic classification based on machine learning[J]. Journal of Information Engineering University, 2023, 24(4): 447-453.
[21] 徐宁, 冯志伟, 陈隆耀. 一种基于流量特征的加密挖矿行为检测识别方法[J]. 江西通信科技, 2023(1): 45-47.
XU N, FENG Z W, CHEN L Y. A detection and identification method of encrypted mining behavior based on traffic characteristics[J]. Jiangxi Communication Science & Technology, 2023(1): 45-47.
[22] ZHANG W, YOSHIDA T, TANG X J. A comparative study of TF*IDF, LSI and multi-words for text classification[J]. Expert Systems with Applications, 2011, 38(3): 2758-2765.
[23] 武永亮, 赵书良, 李长镜, 等. 基于TF-IDF和余弦相似度的文本分类方法[J]. 中文信息学报, 2017, 31(5): 138-145. WU Y L, ZHAO S L, LI C J, et al. Text classification method based on TF-IDF and cosine similarity[J]. Journal of Chinese Information Processing, 2017, 31(5): 138-145.
[24] QADER W A, AMEEN M M, AHMED B I. An overview of bag of words; importance, implementation, applications, and challenges[C]//Proceedings of the 2019 International Engineering Conference. Piscataway: IEEE, 2019: 200-204.
[25] VAJJALA S, BANERJEE S. A study of N-gram and embedding representations for native language identification[C]//Proceedings of the 12th Workshop on Innovative Use of NLP for Building Educational Applications. Stroudsburg: ACL, 2017: 240-248.
[26] CHURCH K W. Word2Vec[J]. Natural Language Engineering, 2017, 23(1): 155-162.
[27] GOUTTE C, GAUSSIER E. A probabilistic interpretation of precision, recall and F-score, with implication for evaluation[C]//Advances in Information Retrieval. Berlin, Heidelberg: Springer, 2005: 345-359.