{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,20]],"date-time":"2025-07-20T03:30:56Z","timestamp":1752982256315,"version":"3.40.3"},"publisher-location":"Cham","reference-count":45,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783031222948"},{"type":"electronic","value":"9783031222955"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"DOI":"10.1007\/978-3-031-22295-5_8","type":"book-chapter","created":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T02:36:12Z","timestamp":1672540572000},"page":"139-158","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["DeCrypto: Finding Cryptocurrency Miners on\u00a0ISP Networks"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0544-8424","authenticated-orcid":false,"given":"Richard","family":"Pln\u00fd","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8281-618X","authenticated-orcid":false,"given":"Karel","family":"Hynek","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7794-9511","authenticated-orcid":false,"given":"Tom\u00e1\u0161","family":"\u010cejka","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2023,1,1]]},"reference":[{"key":"8_CR1","unstructured":"Baciu, P.: Czech prime minister accuses pirate party of mining bitcoin (2018). https:\/\/bitcoinist.com\/prime-minister-accuses-czech-pirate-party-of-mining-bitcoin-so-what\/"},{"issue":"9","key":"8_CR2","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1109\/MC.2017.3571056","volume":"50","author":"M Bedford Taylor","year":"2017","unstructured":"Bedford Taylor, M.: The evolution of bitcoin hardware. Computer 50(9), 58\u201366 (2017). https:\/\/doi.org\/10.1109\/MC.2017.3571056","journal-title":"Computer"},{"issue":"1","key":"8_CR3","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1023\/A:1010933404324","volume":"45","author":"L Breiman","year":"2001","unstructured":"Breiman, L.: Random forests. Mach. Learn. 45(1), 5\u201332 (2001)","journal-title":"Mach. Learn."},{"key":"8_CR4","unstructured":"BTC.com: Professional data service for global blockchain enthusiasts. https:\/\/explorer.btc.com\/"},{"key":"8_CR5","unstructured":"Bushra Alahmadi, L.A., Martinovic, I.: 99% false positives: a qualitative study of SOC analysts\u2019 perspectives on security alarms. In: 31st USENIX Security Symposium (USENIX Security 2022). USENIX Association, Boston (2022). https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/alahmadi"},{"issue":"3","key":"8_CR6","doi-asserted-by":"publisher","first-page":"14","DOI":"10.1109\/79.998079","volume":"19","author":"O Capp\u00e9","year":"2002","unstructured":"Capp\u00e9, O., Moulines, E., Pesquet, J.C., Petropulu, A.P., Yang, X.: Long-range dependence and heavy-tail modeling for teletraffic data. IEEE Signal Process. Mag. 19(3), 14\u201327 (2002)","journal-title":"IEEE Signal Process. Mag."},{"key":"8_CR7","doi-asserted-by":"crossref","unstructured":"Cejka, T., et al.: NEMEA: a framework for network traffic analysis. In: 12th International Conference on Network and Service Management (CNSM) (2016)","DOI":"10.1109\/CNSM.2016.7818417"},{"key":"8_CR8","unstructured":"Cimpanu, C.: Malvertising campaign mines cryptocurrency right in your browser (2017). https:\/\/www.malwarebytes.com\/malvertising"},{"key":"8_CR9","unstructured":"CoinMarketCap: Coinmarketcap. https:\/\/coinmarketcap.com. Accessed 8 Aug 2022"},{"issue":"2","key":"8_CR10","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1214\/aoms\/1177698950","volume":"38","author":"AP Dempster","year":"1967","unstructured":"Dempster, A.P.: Upper and lower probabilities induced by a multivalued mapping. Ann. Math. Stat. 38(2), 325\u2013339 (1967). https:\/\/doi.org\/10.1214\/aoms\/1177698950","journal-title":"Ann. Math. Stat."},{"key":"8_CR11","unstructured":"FBI: FBI: internet crime report 2021. https:\/\/www.ic3.gov\/Media\/PDF\/AnnualReport\/2021_IC3Report.pdf"},{"key":"8_CR12","unstructured":"Hayward, A.: What are privacy coins? Monero, zcash, and dash explained (2021). https:\/\/decrypt.co\/resources\/what-are-privacy-coins-monero-zcash-and-dash-explained"},{"key":"8_CR13","unstructured":"Hill, K.: Government researcher misused supercomputers to mine a surprisingly small amount of bitcoin (2014). https:\/\/www.forbes.com\/sites\/kashmirhill\/2014\/06\/06\/government-researcher-misused-supercomputers-to-mine-bitcoin\/"},{"issue":"4","key":"8_CR14","doi-asserted-by":"publisher","first-page":"2037","DOI":"10.1109\/COMST.2014.2321898","volume":"16","author":"R Hofstede","year":"2014","unstructured":"Hofstede, R., et al.: Flow monitoring explained: from packet capture to data analysis with NetFlow and IPFIX. IEEE Commun. Surv. Tutor. 16(4), 2037\u20132064 (2014). https:\/\/doi.org\/10.1109\/COMST.2014.2321898","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"8_CR15","unstructured":"Hruska, J.: Browser-based mining malware found on pirate bay, other sites (2017). https:\/\/www.extremetech.com\/internet\/255971-browser-based-cryptocurrency-malware-appears-online-pirate-bay"},{"key":"8_CR16","doi-asserted-by":"publisher","unstructured":"Hynek, K., \u010cejka, T., \u017d\u00e1dn\u00edk, M., Kub\u00e1tov\u00e1, H.: Evaluating bad hosts using adaptive blacklist filter. In: 2020 9th Mediterranean Conference on Embedded Computing (MECO), pp. 1\u20135 (2020). https:\/\/doi.org\/10.1109\/MECO49872.2020.9134244","DOI":"10.1109\/MECO49872.2020.9134244"},{"key":"8_CR17","unstructured":"Jamieson, S.: The ethics and legality of port scanning. Technical report, SANS Institute (2001). https:\/\/www.sans.org\/white-papers\/71\/"},{"key":"8_CR18","unstructured":"JustFirewalls: 2022 cyber security trends: Top 5 threats to watch out for this year. https:\/\/www.justfirewalls.com\/2022-cyber-security-trends-top-5-threats-to-watch-out-for-this-year"},{"key":"8_CR19","doi-asserted-by":"publisher","unstructured":"Kharraz, A., et al.: Outguard: detecting in-browser covert cryptocurrency mining in the wild. In: The World Wide Web Conference, WWW 2019, pp. 840\u2013852. Association for Computing Machinery, New York (2019). https:\/\/doi.org\/10.1145\/3308558.3313665","DOI":"10.1145\/3308558.3313665"},{"key":"8_CR20","unstructured":"Khatri, Y.: Crypto mining malware has netted nearly 5% of all monero, says research (2019). https:\/\/www.coindesk.com\/markets\/2019\/01\/10\/crypto-mining-malware-has-netted-nearly-5-of-all-monero-says-research\/"},{"key":"8_CR21","doi-asserted-by":"publisher","unstructured":"Liu, J., Zhao, Z., Cui, X., Wang, Z., Liu, Q.: A novel approach for detecting browser-based silent miner. In: 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC), pp. 490\u2013497 (2018). https:\/\/doi.org\/10.1109\/DSC.2018.00079","DOI":"10.1109\/DSC.2018.00079"},{"key":"8_CR22","unstructured":"McAffee: Mcafee labs threats report (2018). https:\/\/www.mcafee.com\/enterprise\/en-us\/assets\/reports\/rp-quarterly-threats-dec-2018.pdf"},{"key":"8_CR23","unstructured":"McMillan, R.: Harvard researcher was caught mining the bitcoin derivative, dogecoin (2014). https:\/\/www.wired.com\/2014\/02\/harvard-dogecoin\/"},{"key":"8_CR24","unstructured":"MiningPoolStats: Miningpoolstats. https:\/\/miningpoolstats.stream\/monero"},{"key":"8_CR25","doi-asserted-by":"publisher","unstructured":"Mu\u00f1oz, J.Z.I., Su\u00e1rez-Varela, J., Barlet-Ros, P.: Detecting cryptocurrency miners with NetFlow\/IPFIX network measurements. In: 2019 IEEE International Symposium on Measurements Networking (M N), pp. 1\u20136 (2019). https:\/\/doi.org\/10.1109\/IWMN.2019.8804995","DOI":"10.1109\/IWMN.2019.8804995"},{"key":"8_CR26","unstructured":"Nakamoto, S.: A peer-to-peer electronic cash system. Bitcoin.org 4, 2 (2008). https:\/\/bitcoin.org\/bitcoin.pdf"},{"key":"8_CR27","unstructured":"Palatinus, M.: Stratum mining protocol. Slushpool.com (2019). https:\/\/slushpool.com\/help\/manual\/stratum-protocol"},{"key":"8_CR28","doi-asserted-by":"publisher","unstructured":"Pastrana, S., Suarez-Tangil, G.: A first look at the crypto-mining malware ecosystem: a decade of unrestricted wealth. In: Proceedings of the Internet Measurement Conference, IMC 2019, pp. 73\u201386. Association for Computing Machinery, New York (2019). https:\/\/doi.org\/10.1145\/3355369.3355576","DOI":"10.1145\/3355369.3355576"},{"issue":"11","key":"8_CR29","doi-asserted-by":"publisher","first-page":"8021","DOI":"10.1007\/s00521-018-3595-x","volume":"31","author":"A Pekta\u015f","year":"2018","unstructured":"Pekta\u015f, A., Acarman, T.: Deep learning to detect botnet via network flow summaries. Neural Comput. Appl. 31(11), 8021\u20138033 (2018). https:\/\/doi.org\/10.1007\/s00521-018-3595-x","journal-title":"Neural Comput. Appl."},{"key":"8_CR30","unstructured":"Pln\u00fd, R., Hynek, K., \u010cejka, T.: Decrypto. https:\/\/github.com\/plnyrich\/DeCrypto"},{"key":"8_CR31","unstructured":"Pln\u00fd, R., Hynek, K., \u010cejka, T.: Rules generator. https:\/\/github.com\/plnyrich\/RulesGenerator"},{"key":"8_CR32","doi-asserted-by":"publisher","unstructured":"Pln\u00fd, R., Hynek, K., \u010cejka, T.: Datasets of cryptomining communication (2022). https:\/\/doi.org\/10.5281\/zenodo.7189292","DOI":"10.5281\/zenodo.7189292"},{"key":"8_CR33","unstructured":"PurpleSec LLC: Cyber Security Statistics: The Ultimate List of Stats, Data, & Trends for 2022 (2022). https:\/\/purplesec.us\/resources\/cyber-security-statistics\/#Start"},{"key":"8_CR34","volume-title":"C4.5: Programs for Machine Learning","author":"JR Quinlan","year":"1993","unstructured":"Quinlan, J.R.: C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers Inc., San Francisco (1993)"},{"key":"8_CR35","first-page":"54","volume":"3","author":"R Recabarren","year":"2017","unstructured":"Recabarren, R., Carbunar, B.: Hardening stratum, the bitcoin pool mining protocol. Proc. Priv. Enhanc. Technol. 3, 54\u201371 (2017)","journal-title":"Proc. Priv. Enhanc. Technol."},{"key":"8_CR36","doi-asserted-by":"publisher","unstructured":"Ren, L., Ward, P.A.: Pooled mining is driving blockchains toward centralized systems. In: 2019 38th International Symposium on Reliable Distributed Systems Workshops (SRDSW), pp. 43\u201348 (2019). https:\/\/doi.org\/10.1109\/SRDSW49218.2019.00015","DOI":"10.1109\/SRDSW49218.2019.00015"},{"key":"8_CR37","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1007\/978-3-642-41136-6_5","volume-title":"Empirical Inference","author":"RE Schapire","year":"2013","unstructured":"Schapire, R.E.: Explaining AdaBoost. In: Sch\u00f6lkopf, B., Luo, Z., Vovk, V. (eds.) Empirical Inference, pp. 37\u201352. Springer, Heidelberg (2013). https:\/\/doi.org\/10.1007\/978-3-642-41136-6_5"},{"key":"8_CR38","unstructured":"Scornet, E.: Trees, forests, and impurity-based variable importance. arXiv preprint arXiv:2001.04295 (2020)"},{"key":"8_CR39","doi-asserted-by":"publisher","DOI":"10.1515\/9780691214696","volume-title":"A Mathematical Theory of Evidence","author":"G Shafer","year":"2021","unstructured":"Shafer, G.: A Mathematical Theory of Evidence. Princeton University Press, Princeton (2021). https:\/\/doi.org\/10.1515\/9780691214696"},{"key":"8_CR40","doi-asserted-by":"publisher","unstructured":"Swedan, A., Khuffash, A.N., Othman, O., Awad, A.: Detection and prevention of malicious cryptocurrency mining on internet-connected devices. In: Proceedings of the 2nd International Conference on Future Networks and Distributed Systems, ICFNDS 2018. Association for Computing Machinery, New York (2018). https:\/\/doi.org\/10.1145\/3231053.3231076","DOI":"10.1145\/3231053.3231076"},{"key":"8_CR41","doi-asserted-by":"publisher","first-page":"164","DOI":"10.1016\/j.catena.2016.06.004","volume":"145","author":"P Tsangaratos","year":"2016","unstructured":"Tsangaratos, P., Ilia, I.: Comparison of a logistic regression and na\u00efve bayes classifier in landslide susceptibility assessments: the influence of models complexity and training dataset size. CATENA 145, 164\u2013179 (2016). https:\/\/doi.org\/10.1016\/j.catena.2016.06.004","journal-title":"CATENA"},{"key":"8_CR42","doi-asserted-by":"publisher","unstructured":"Vesel\u00fd, V., \u017d\u00e1dn\u00edk, M.: How to detect cryptocurrency miners? By traffic forensics! Digit. Invest. 31, 100884 (2019). https:\/\/doi.org\/10.1016\/j.diin.2019.08.002","DOI":"10.1016\/j.diin.2019.08.002"},{"key":"8_CR43","unstructured":"Vuijsje, E.: Cryptocurrency malvertising campaign hijacks users\u2019 browsers. https:\/\/www.geoedge.com\/cryptocurrency-malvertising-campaign-hijacks-users-browsers\/"},{"key":"8_CR44","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.physrep.2020.10.005","volume":"901","author":"M Watorek","year":"2021","unstructured":"Watorek, M., Dro\u017cd\u017c, S., Kwapin\u0144, J., Minati, L., Oswiecimka, P., Stanuszek, M.: Multiscale characteristics of the emerging global cryptocurrency market. Phys. Rep. 901, 1\u201382 (2021). https:\/\/doi.org\/10.1016\/j.physrep.2020.10.005. Multiscale characteristics of the emerging global cryptocurrency market","journal-title":"Phys. Rep."},{"key":"8_CR45","unstructured":"Zvik, E.W.: The crypto mining threat: the security risk posed by bitcoin and what you can do about it (2018). https:\/\/www.catonetworks.com\/blog\/the-crypto-mining-threat\/"}],"container-title":["Lecture Notes in Computer Science","Secure IT Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-22295-5_8","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T02:42:15Z","timestamp":1672540935000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-22295-5_8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783031222948","9783031222955"],"references-count":45,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-22295-5_8","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"1 January 2023","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"NordSec","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Nordic Conference on Secure IT Systems","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Reykjavic","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Iceland","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2022","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30 November 2022","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2 December 2022","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"nordsec2022","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/nordsec2022.ru.is\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"easychair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"85","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"20","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"24% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"7","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}