Cryptomining poses significant security risks, yet traditional detection methods like blacklists and Deep Packet Inspection (DPI) are often ineffective against encrypted mining traffic and suffer from high false positive rates. In this paper, we propose a practical encrypted cryptomining traffic detection mechanism. It consists of a two-stage detection framework, which can effectively provide fine-grained detection results by machine learning and reduce false positives from classifiers through active probing. Our system achieves an F1-score of 0.99 and identifies specific cryptocurrencies with a 99.39\% accuracy rate. Extensive testing across various mining pools confirms the effectiveness of our approach, offering a more precise and reliable solution for identifying cryptomining activities.

翻译：加密挖矿活动构成重大安全风险，然而传统检测方法（如黑名单和深度包检测）对加密挖矿流量往往失效，且存在高误报率。本文提出一种实用的加密挖矿流量检测机制。该机制采用两阶段检测框架，能够通过机器学习有效提供细粒度检测结果，并通过主动探测降低分类器的误报。我们的系统实现了0.99的F1分数，并以99.39%的准确率识别具体加密货币类型。在不同矿池上的广泛测试验证了该方法的有效性，为识别加密挖矿活动提供了更精确可靠的解决方案。