Patent attributes
A method of monitoring network traffic for cryptojacking activity is provided. A request is received from a protected host. It is determined whether the request is a cryptocurrency request based on whether the request uses a protocol specified for requests belonging to the cryptocurrency communication. In response to a determination that the request is a cryptocurrency request for the cryptocurrency, a second request is submitted to a destination indicated by the request, wherein the second request is formatted as a cryptocurrency request for the cryptocurrency. A determination is made whether a reply to the second request from the destination is a cryptocurrency response for the cryptocurrency based on whether the response uses a protocol specified for a response that belongs to communication associated with the cryptocurrency. An intervention action is caused in response to a determination that the reply to the second request from the destination is a cryptocurrency response for the cryptocurrency.
