MineCap: super incremental learning for detecting and blocking cryptocurrency mining on software-defined networking

• Published in: Annales des télécommunications Vol. 75; no. 3-4; pp. 121 - 131
• Main Authors: Neto, Helio N. Cunha, Lopez, Martin Andreoni, Fernandes, Natalia C., Mattos, Diogo M. F.
• Format: Journal Article
• Language: English
• Published: Cham Springer International Publishing 01-04-2020; Springer Nature B.V
• Subjects: Circuits; Classifiers; Communications Engineering; Computer Communication Networks; Cryptocurrency mining; Digital currencies; Distance learning; Energy consumption; Engineering; Information and Communication; Information Systems and Communication Service; Machine learning; Networks; R & D/Technology Policy; Signal,Image and Speech Processing; Software-defined networking; Mining; Incremental learning; Super learner; Machine learning; Cryptocurrency; SDN; Super incremental learning
• ISSN: 0003-4347; 1958-9395
• DOI: 10.1007/s12243-019-00744-4

Covert mining of cryptocurrency implies the use of valuable computing resources and high energy consumption. In this paper, we propose MineCap, a dynamic online mechanism for detecting and blocking covert cryptocurrency mining flows, using machine learning on software-defined networking. The proposed mechanism relies on Spark Streaming for online processing of network flows, and, when identifying a mining flow, it requests the flow blocking to the network controller. We also propose a learning technique called super incremental learning, a variant of the super learner applied to online learning, which takes the classification probabilities of an ensemble of classifiers as features for an incremental learning classifier. Hence, we design an accurate mechanism to classify mining flows that learn with incoming data with an average of 98% accuracy, 99% precision, 97% sensitivity, and 99.9% specificity and avoid concept drift–related issues.