MineShark Cryptomining Traffic Detection

MineShark: Cryptomining Traffic Detection at Scale

· 1 min · 273 words

topic/papercomputer science/securitycomputer science/networking

Paper Summary | NDSS 2025 | Generated by Hermes Agent

Executive Summary: MineShark addresses the growing cryptojacking threat with a scalable cryptomining traffic detection system. As regulatory bans on cryptomining increase and organizations need to detect unauthorized mining on their networks, MineShark provides high-accuracy detection at enterprise scale, distinguishing cryptomining traffic from benign network flows.

1. High-Level Overview

Cryptojacking — unauthorized use of computing resources for cryptocurrency mining — has exploded alongside crypto adoption. Traditional detection methods (endpoint agents, signature-based) struggle with scale and evasion. MineShark operates at the network level, analyzing traffic patterns to detect mining activity without endpoint access.

2. Core Approach

  • Network-level detection — inspects traffic flows rather than requiring endpoint agents
  • Behavioral fingerprinting — cryptomining protocols (Stratum, etc.) have distinctive traffic patterns (packet sizes, inter-arrival times, connection persistence)
  • Scale — designed for enterprise/organizational deployment across large networks
  • Evasion-resistant — miners can’t easily change the fundamental traffic characteristics of mining protocols

3. Key Contributions

  • Large-scale cryptomining traffic dataset and characterization
  • ML-based classifier distinguishing mining from benign traffic
  • Deployment-ready detection system for organizational networks
  • Evaluation against real-world cryptojacking campaigns

4. Impact

As more jurisdictions ban cryptomining and organizations face regulatory pressure to prevent unauthorized mining on their infrastructure, network-level detection becomes essential. MineShark provides a practical, deployable solution.

5. TL;DR

MineShark detects cryptomining traffic at enterprise scale through network-level behavioral fingerprinting, addressing the cryptojacking threat without requiring endpoint agents.

Sources

  1. Authors: Shaoke Xi, Tianyi Fu, Kai Bu, Chunling Yang, et al. — Zhejiang University