信息网络安全 ›› 2026, Vol. 26 ›› Issue (3): 389-398.doi: 10.3969/j.issn.1671-1122.2026.03.005

• 入选论文 • 上一篇    下一篇

基于多源检测与AI行为分析的挖矿木马协同防御研究

康文杰, 刘怡果, 刘绪崇(), 赵薇, 欧阳天健, 李嘉欣   

  1. 湖南警察学院信息技术(网监)系,长沙 410138
  • 收稿日期:2025-08-11 出版日期:2026-03-10 发布日期:2026-03-30
  • 通讯作者: 刘绪崇 E-mail:liuxuchong@163.com
  • 作者简介:康文杰(1987—),男,山西,副教授,博士,CCF高级会员,主要研究方向为网络空间安全|刘怡果(2004—),女,湖南,本科,主要研究方向为网络安全|刘绪崇(1974—),男,湖南,教授,博士,主要研究方向为网络安全|赵薇(1982—),女,湖南,教授,博士,主要研究方向为网络安全|欧阳天健(2004—),男,湖南,本科,主要研究方向为网络安全|李嘉欣(2004—),女,湖南,本科,主要研究方向为网络安全
  • 基金资助:
    湖南省重大科技攻关项目(2025QK2008, 2024QK2010);湖南省重点研发计划(2024AQ2023);湖南省自然科学基金青年科学基金(2023JJ40272);湖南省教育厅科学研究重点项目(25A0701);湖南省大学生创新创业训练计划(S202411534026)

Research on Collaborative Defense against Cryptojacking Malware Based on Multi-Source Detection and AI Behavior Analysis

KANG Wenjie, LIU Yiguo, LIU Xuchong(), ZHAO Wei, OUYANG Tianjian, LI Jiaxin   

  1. Department of Information Technology (Network Supervision), Hunan Police Academy, Changsha 410138, China
  • Received:2025-08-11 Online:2026-03-10 Published:2026-03-30

摘要:

随着互联网与新型信息技术的深度融合,跨行业、跨地域、跨系统的多维度互联互通已成为现代信息技术发展的核心特征。区块链加密货币的持续增长与普及,推动了非法挖矿活动的规模化扩张,对个人隐私保护、企业数据资产安全及关键信息基础设施构成持续性威胁。在此背景下,针对挖矿木马的应急响应机制已被提升至国家网络安全战略层面。文章聚焦挖矿木马攻击链的防御与处置问题,构建了多维监测体系。为验证多源检测与AI行为异常检测的协同可行性,文章在隔离主机环境中集成静态、主机与网络3侧特征采集,采用学习型融合(Stacking)将多源得分与异常评分统一决策,对检测效果与响应时延开展阶段性对比评估。通过基于多源检测技术对挖矿木马的传播路径进行逆向建模,形成了覆盖攻击预防、感染检测、威胁清除的全流程应急响应方案,最后设计了基于多源检测与AI行为分析协同防御方案,比传统单一检测方法的效果更好。

关键词: 网络安全, 网络攻击, 挖矿木马, 应急响应

Abstract:

With the deep integration of the internet and emerging information technologies, multi-dimensional interconnectivity across industries, regions, and systems has become a core characteristic of modern technological development. The continuous growth and proliferation of blockchain cryptocurrencies have driven the large-scale expansion of illegal mining activities, posing persistent threats to personal privacy, corporate data assets, and critical information infrastructure. In this context, emergency response mechanisms against mining malware have been elevated to the national cybersecurity strategy level. This paper focused on the defense and remediation of mining malware attack chains by constructing a multi-dimensional monitoring system. To verify the feasibility of collaboration between multi-source detection and AI-based behavioral anomaly detection, the study integrated static, host, and network-level feature collection within an isolated environment. A stacking-based ensemble learning approach was adopted to unify multi-source scores and anomaly assessments for final decision-making, with periodic comparative evaluations conducted on detection performance and response latency. By leveraging multi-source detection techniques to reverse-model the propagation pathways of mining malware, a comprehensive emergency response framework was established, covering attack prevention, infection detection, and threat removal. The proposed collaborative defense mechanism combining multi-source detection and AI-driven behavioral analysis demonstrates superior detection effectiveness compared to traditional single-method detection techniques.

Key words: network security, network attacks, mining trojan, emergency response

中图分类号: