Skip to content

Commit 8aa09f9

Browse files
IvanNardiIvanNardi
authored
mining: a better identification logic (#2221)
It is quite simple (and not so efficient) but it should fix all the false positives reported in #2216. Add support for Ethereum mining. Merge all the mining traces. Remove duplicated function. Close #2216
1 parent 308b266 commit 8aa09f9

File tree

8 files changed

+71
-94
lines changed

8 files changed

+71
-94
lines changed

‎fuzz/dictionary.dict

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,3 +132,11 @@
132132

133133
"='im.truphone.com'"
134134
"=\"im.truphone.com\""
135+
136+
#Mining
137+
138+
"\"mining.subscribe\""
139+
"\"mining.configure\""
140+
"zcash"
141+
"\"agent\":\"xmr-stak-cpu"
142+
"\"method\": \"eth_submitLogin"

‎src/lib/protocols/ethereum.c

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -34,19 +34,6 @@ enum ether_disc_packet_type {
3434
DISC_ENRRESPONSE = 0x06
3535
};
3636

37-
/* ************************************************************************** */
38-
39-
u_int32_t mining_make_lru_cache_key(struct ndpi_flow_struct *flow) {
40-
u_int32_t key;
41-
42-
/* network byte order */
43-
if(flow->is_ipv6)
44-
key = ndpi_quick_hash(flow->c_address.v6, 16) + ndpi_quick_hash(flow->s_address.v6, 16);
45-
else
46-
key = flow->c_address.v4 + flow->s_address.v4;
47-
48-
return key;
49-
}
5037

5138
/* ************************************************************************** */
5239

‎src/lib/protocols/mining.c

Lines changed: 34 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* mining.c [ZCash, Monero]
2+
* mining.c
33
*
44
* Copyright (C) 2018-22 - ntop.org
55
*
@@ -28,7 +28,7 @@
2828

2929
/* ************************************************************************** */
3030

31-
u_int32_t make_mining_key(struct ndpi_flow_struct *flow) {
31+
u_int32_t mining_make_lru_cache_key(struct ndpi_flow_struct *flow) {
3232
u_int32_t key;
3333

3434
/* network byte order */
@@ -45,7 +45,7 @@ u_int32_t make_mining_key(struct ndpi_flow_struct *flow) {
4545
static void cacheMiningHostTwins(struct ndpi_detection_module_struct *ndpi_struct,
4646
struct ndpi_flow_struct *flow) {
4747
if(ndpi_struct->mining_cache)
48-
ndpi_lru_add_to_cache(ndpi_struct->mining_cache, make_mining_key(flow), NDPI_PROTOCOL_MINING, ndpi_get_current_time(flow));
48+
ndpi_lru_add_to_cache(ndpi_struct->mining_cache, mining_make_lru_cache_key(flow), NDPI_PROTOCOL_MINING, ndpi_get_current_time(flow));
4949
}
5050

5151
/* ************************************************************************** */
@@ -56,31 +56,37 @@ static void ndpi_search_mining(struct ndpi_detection_module_struct *ndpi_struct,
5656

5757
NDPI_LOG_DBG(ndpi_struct, "search MINING\n");
5858

59-
if(packet->payload_packet_len > 10) {
60-
if(ndpi_strnstr((const char *)packet->payload, "{", packet->payload_packet_len)
61-
&& (ndpi_strnstr((const char *)packet->payload, "\"method\":", packet->payload_packet_len)
62-
|| ndpi_strnstr((const char *)packet->payload, "\"blob\":", packet->payload_packet_len)
63-
/* || ndpi_strnstr((const char *)packet->payload, "\"id\":", packet->payload_packet_len) - Removed as too generic */
64-
)
65-
) {
66-
/*
67-
ZCash
68-
69-
{"method":"login","params":{"login":"4BCeEPhodgPMbPWFN1dPwhWXdRX8q4mhhdZdA1dtSMLTLCEYvAj9QXjXAfF7CugEbmfBhgkqHbdgK9b2wKA6nqRZQCgvCDm.cb2b73415c4faf214035a73b9d947c202342f3bf3bdf632132bd6d7af98cb257.ryzen","pass":"x","agent":"xmr-stak-cpu/1.3.0-1.5.0"},"id":1}
70-
{"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"479059546883218","job":{"blob":"0606e89883d205a65d8ee78991838a1cf3ec2ebbc5fb1fa43dec5fa1cd2bee4069212a549cd731000000005a88235653097aa3e97ef2ceef4aee610751a828f9be1a0758a78365fb0a4c8c05","job_id":"722134174127131","target":"dc460300"},"status":"OK"}}
71-
{"method":"submit","params":{"id":"479059546883218","job_id":"722134174127131","nonce":"98024001","result":"c9be9381a68d533c059d614d961e0534d7d8785dd5c339c2f9596eb95f320100"},"id":1}
72-
73-
Monero
74-
75-
{"method":"login","params":{"login":"4BCeEPhodgPMbPWFN1dPwhWXdRX8q4mhhdZdA1dtSMLTLCEYvAj9QXjXAfF7CugEbmfBhgkqHbdgK9b2wKA6nqRZQCgvCDm.cb2b73415c4faf214035a73b9d947c202342f3bf3bdf632132bd6d7af98cb257.ryzen","pass":"x","agent":"xmr-stak-cpu/1.3.0-1.5.0"},"id":1}
76-
{"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"479059546883218","job":{"blob":"0606e89883d205a65d8ee78991838a1cf3ec2ebbc5fb1fa43dec5fa1cd2bee4069212a549cd731000000005a88235653097aa3e97ef2ceef4aee610751a828f9be1a0758a78365fb0a4c8c05","job_id":"722134174127131","target":"dc460300"},"status":"OK"}}
77-
{"method":"submit","params":{"id":"479059546883218","job_id":"722134174127131","nonce":"98024001","result":"c9be9381a68d533c059d614d961e0534d7d8785dd5c339c2f9596eb95f320100"},"id":1}
78-
*/
79-
ndpi_snprintf(flow->protos.mining.currency, sizeof(flow->protos.mining.currency), "%s", "ZCash/Monero");
80-
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
81-
cacheMiningHostTwins(ndpi_struct, flow);
82-
return;
83-
}
59+
/* Quick test: we are looking for only Json format */
60+
if(packet->payload[0] != '{') {
61+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
62+
return;
63+
}
64+
65+
/* STRATUMv1 */
66+
if(ndpi_strnstr((const char *)packet->payload, "\"mining.subscribe\"", packet->payload_packet_len) ||
67+
ndpi_strnstr((const char *)packet->payload, "\"mining.configure\"", packet->payload_packet_len)) {
68+
69+
/* Try matching some zcash domains like "eu1-zcash.flypool.org" */
70+
if(ndpi_strnstr((const char *)packet->payload, "zcash", packet->payload_packet_len))
71+
ndpi_snprintf(flow->protos.mining.currency, sizeof(flow->protos.mining.currency), "%s", "ZCash");
72+
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
73+
cacheMiningHostTwins(ndpi_struct, flow);
74+
return;
75+
}
76+
77+
/* Xmr-stak-cpu is a ZCash/Monero CPU miner */
78+
if(ndpi_strnstr((const char *)packet->payload, "\"agent\":\"xmr-stak-cpu", packet->payload_packet_len)) {
79+
ndpi_snprintf(flow->protos.mining.currency, sizeof(flow->protos.mining.currency), "%s", "ZCash/Monero");
80+
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
81+
cacheMiningHostTwins(ndpi_struct, flow);
82+
return;
83+
}
84+
85+
if(ndpi_strnstr((const char *)packet->payload, "\"method\": \"eth_submitLogin", packet->payload_packet_len)) {
86+
ndpi_snprintf(flow->protos.mining.currency, sizeof(flow->protos.mining.currency), "%s", "Ethereum");
87+
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
88+
cacheMiningHostTwins(ndpi_struct, flow);
89+
return;
8490
}
8591

8692
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);

‎tests/cfgs/default/pcap/monero-mining.pcap renamed to ‎tests/cfgs/default/pcap/mining.pcapng

168 KB
Binary file not shown.

‎tests/cfgs/default/pcap/zcash.pcap

-22.4 KB
Binary file not shown.

‎tests/cfgs/default/result/mining.pcapng.out

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
DPI Packets (TCP): 17 (4.25 pkts/flow)
2+
Confidence DPI : 4 (flows)
3+
Num dissector calls: 105 (26.25 diss/flow)
4+
LRU cache ookla: 0/0/0 (insert/search/found)
5+
LRU cache bittorrent: 0/0/0 (insert/search/found)
6+
LRU cache zoom: 0/0/0 (insert/search/found)
7+
LRU cache stun: 0/0/0 (insert/search/found)
8+
LRU cache tls_cert: 0/0/0 (insert/search/found)
9+
LRU cache mining: 4/0/0 (insert/search/found)
10+
LRU cache msteams: 0/0/0 (insert/search/found)
11+
LRU cache stun_zoom: 0/0/0 (insert/search/found)
12+
Automa host: 0/0 (search/found)
13+
Automa domain: 0/0 (search/found)
14+
Automa tls cert: 0/0 (search/found)
15+
Automa risk mask: 0/0 (search/found)
16+
Automa common alpns: 0/0 (search/found)
17+
Patricia risk mask: 0/0 (search/found)
18+
Patricia risk mask IPv6: 0/0 (search/found)
19+
Patricia risk: 1/0 (search/found)
20+
Patricia risk IPv6: 0/0 (search/found)
21+
Patricia protocols: 8/0 (search/found)
22+
Patricia protocols IPv6: 0/0 (search/found)
23+
24+
Mining 673 219078 4
25+
26+
1 TCP 192.168.2.148:46838 <-> 94.23.199.191:3333 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: Mining/99][159 pkts/143155 bytes <-> 113 pkts/13204 bytes][Goodput ratio: 93/43][1091.42 sec][currency: ZCash][bytes ratio: 0.831 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 7234/8131 71734/71815 15224/15291][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 900/117 1514/376 709/99][Risk: ** Unsafe Protocol **][Risk Score: 10][PLAIN TEXT (method)][Plen Bins: 28,2,0,1,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,29,29,0,0]
27+
2 TCP 147.229.13.222:49307 <-> 185.71.66.39:9999 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 5][cat: Mining/99][112 pkts/10941 bytes <-> 97 pkts/20817 bytes][Goodput ratio: 45/74][295.93 sec][currency: Ethereum][bytes ratio: -0.311 (Download)][IAT c2s/s2c min/avg/max/stddev: 8/0 2992/2893 9784/10017 3265/3384][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 98/215 259/297 57/112][Risk: ** Unsafe Protocol **][Risk Score: 10][PLAIN TEXT (worker)][Plen Bins: 0,1,28,0,12,0,0,58,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
28+
3 TCP 192.168.2.92:55190 <-> 178.32.196.217:9050 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: Mining/99][83 pkts/11785 bytes <-> 62 pkts/8859 bytes][Goodput ratio: 53/53][1154.54 sec][currency: ZCash/Monero][bytes ratio: 0.142 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 15953/19141 60205/60205 20621/20751][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 142/143 326/369 91/88][Risk: ** Unsafe Protocol **][Risk Score: 10][PLAIN TEXT (method)][Plen Bins: 0,40,0,0,0,44,0,13,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
29+
4 TCP 192.168.2.148:53846 <-> 116.211.167.195:3333 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: Mining/99][24 pkts/4455 bytes <-> 23 pkts/5862 bytes][Goodput ratio: 70/78][1065.16 sec][currency: ZCash][bytes ratio: -0.136 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 46166/51528 195463/195463 61020/65306][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 186/255 1498/364 395/138][Risk: ** Unsafe Protocol **][Risk Score: 10][PLAIN TEXT (method)][Plen Bins: 4,13,4,8,0,0,0,0,0,61,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,4,0,0]

‎tests/cfgs/default/result/monero-mining.pcap.out

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎tests/cfgs/default/result/zcash.pcap.out

Lines changed: 0 additions & 26 deletions
This file was deleted.

0 commit comments

Comments
 (0)