Identifying computing devices in a managed network that are involved in blockchain-based mining

Patent metadata

Field	Value
Publication number	US-11070632-B2
Application number	US-201816163240-A
Country	US
Kind code	B2
Filing date	Oct 17, 2018
Priority date	Oct 17, 2018
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

An example embodiment relates to discovering computing devices in a managed network that are involved in blockchain-based mining. The example embodiment may involve a proxy server application that is disposed within the managed network, controlled by a remote network management platform, and configured to: provide, to a computing device disposed within the managed network, one or more instructions to identify one or more applications executing on the computing device; determine, for an application of the one or more applications that were identified, a command string used to invoke the application to execute on the computing device; compare the command string to a plurality of identifiers indicative of blockchain-based mining; determine that the command string includes an identifier from the plurality of identifiers indicative of blockchain-based mining; and based on determining that the command string includes the identifier, store, in a database, an indication that the application is associated with blockchain-based mining.

First claim

What is claimed is:

1. A computing system comprising:
a database disposed within a remote network management platform that is associated with a managed network; and
a proxy server application disposed within the managed network, wherein the proxy server application is controlled by the remote network management platform, and wherein the proxy server application is configured to:
provide, to a computing device disposed within the managed network, one or more instructions to identify one or more applications executing on the computing device;
determine, for an application, a command string used to invoke the application to execute on the computing device;
compare the command string to a uniform resource locator (URL) of a blockchain-based mining pool, wherein the blockchain-based mining pool corresponds to a plurality of applications respectively executing on a plurality of computing devices, and wherein the plurality of applications are configured to share processing resources to mine cryptocurrency at least in part by computing a hash for a respective block of a respective blockchain;
determine that the command string includes the URL;
based on determining that the command string includes the URL, provide, to the computing device, one or more additional instructions to perform a measurement of a current processor utilization of the computing device;
determine that the current processor utilization is indicative that the application is associated with the blockchain-based mining pool; and
based on determining that the current processor utilization indicates that the application is associated with the blockchain-based mining pool, store, in the database, an indication that the application is associated with the blockchain-based mining pool.

2. The computing system of claim 1 , wherein the URL comprises a network address, and wherein the indication that the application is associated with the blockchain-based mining pool includes an indication of the network address.

3. The computing system of claim 1 , wherein the proxy server application is configured to:
store, in the database, with the indication that the application is associated with the blockchain-based mining pool, a network address of the computing device, a reference to the application, and the URL.

4. The computing system of claim 1 , wherein the proxy server application is configured to:
store, in the database, with the indication that the application is associated with the blockchain-based mining pool, an indication of the current processor utilization.

5. The computing system of claim 4 , wherein the indication of the current processor utilization includes a portion of the current processor utilization attributable to the application.

6. The computing system of claim 1 , wherein the proxy server application is configured to:
request and receive, from a network traffic database, network traffic logs contained in the network traffic database, wherein the network traffic logs include representations of data packets that were transmitted between the computing device and a server device;
determine that a representation of one of the data packets includes: an Internet Protocol (IP) address used by the computing device, a port number used by the application, and an IP address used by the server device; and
store, in the database, with the indication that the application is associated with the blockchain-based mining pool, the IP address used by the computing device, the port number used by the application, and the IP address used by the server device.

7. The computing system of claim 6 , wherein the proxy server application is configured to:
using the IP address used by the computing device, the port number used by the application, and the IP address used by the server device, determine, from the network traffic logs, a quantity of data that was transmitted between the computing device and the server device;
determine that the quantity of data that was transmitted between the computing device and the server device is within a threshold quantity of data of one or more of the quantities of data historically exchanged between computing devices and server devices during blockchain-based mining; and
in response to determining that the quantity of data that was transmitted between the computing device and the server device is within the threshold quantity of data, store, in the database, with the indication that the application is associated with blockchain-based mining, an indication of the quantity of data that was transmitted between the computing device and the server device.

8. The computing system of claim 1 , wherein the proxy server application is configured to:
based on determining that the command string includes the URL, provide, to the computing device, a command that causes the computing device to terminate execution of the application.

9. The computing system of claim 1 , wherein the proxy server application is configured to:
based on determining that the command string includes the URL, provide, to the computing device, a command that causes the computing device to delete the executable file of the application.

10. The computing system of claim 1 , wherein the proxy server application is configured to:
based on determining that the command string includes the URL, transmit, to a second computing device within the managed network, an alert message incorporating at least part of the indication.

11. A method performed by a proxy server application disposed within a managed network, wherein the proxy server application is controlled by a remote network management platform associated with the managed network, the method comprising:
providing, to a computing device disposed within the managed network, one or more instructions to identify one or more applications executing on the computing device and to measure a current processor utilization of the computing device;
determining, for an application of the one or more applications that were identified, a command string used to invoke the application to execute on the computing device;
comparing the command string to a uniform resource locator (URL) of a blockchain-based mining pool, wherein the blockchain-based mining pool corresponds to a plurality of applications respectively executing on a plurality of computing devices, and wherein the plurality of applications are configured to share processing resources to mine cryptocurrency at least in part by computing a hash for a respective block of a respective blockchain;
determining that the command string includes the URL;
based on determining that the command string includes the URL, determining that the current processor utilization is indicative that the application is associated with the blockchain-based mining pool; and
based on determining that the current processor utilization indicates that the application is associated with the blockchain-based mining pool, storing, in a database disposed within the remote network management platform, an indication that the application is associated with the blockchain-based mining pool.

12. The method of claim 11 , wherein the URL comprises a network address, and wherein the indication that the application is associated with blockchain-based mining includes an indication of the network address.

13. The method of claim 11 , comprising:
storing, in the database, with the indication that the application is associated with the blockchain-based mining pool, a network address of the computing device, a reference to the application, and the URL.

14. The method of claim 11 , comprising:
storing, in the database, wit

Assignees

• Servicenow Inc

Inventors

• Badyan Daniel
• Tal Hail
• Bitterfeld Robert
• Garty Asaf
• Solomon Bary

Classifications

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L41/122

  of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV] · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L9/50 Primary

  using hash chains, e.g. blockchains or hash trees · CPC title