CryptoGuard: Lightweight Hybrid Detection and Response to Host-based Cryptojackers in Linux Cloud Environments

TL;DR

The paper tackles host-based cryptojacking in Linux cloud environments by introducing CryptoGuard, a lightweight hybrid detection and remediation framework. It leverages two-phase syscall monitoring—phase 1 uses Count-Min Sketches for host/VM screening, and phase 2 uses sliding-window syscall embeddings for per-container/process classification—paired with CNN/LSTM detectors and eBPF-driven remediation. The system achieves high accuracy on real-world samples (average F1 ≈ 96% for phase 1 and ≈ 97% for phase 2) while incurring minimal CPU overhead (≈0.06% per host), demonstrating scalability and practicality in cloud deployments. These results suggest CryptoGuard can effectively deter cryptojackers in large-scale Linux cloud environments and provides an open dataset to foster future research and improvements.

Abstract

Host-based cryptomining malware, commonly known as cryptojackers, have gained notoriety for their stealth and the significant financial losses they cause in Linux-based cloud environments. Existing solutions often struggle with scalability due to high monitoring overhead, low detection accuracy against obfuscated behavior, and lack of integrated remediation. We present CryptoGuard, a lightweight hybrid solution that combines detection and remediation strategies to counter cryptojackers. To ensure scalability, CryptoGuard uses sketch- and sliding window-based syscall monitoring to collect behavior patterns with minimal overhead. It decomposes the classification task into a two-phase process, leveraging deep learning models to identify suspicious activity with high precision. To counter evasion techniques such as entry point poisoning and PID manipulation, CryptoGuard integrates targeted remediation mechanisms based on eBPF, a modern Linux kernel feature deployable on any compatible host. Evaluated on 123 real-world cryptojacker samples, it achieves average F1-scores of 96.12% and 92.26% across the two phases, and outperforms state-of-the-art baselines in terms of true and false positive rates, while incurring only 0.06% CPU overhead per host.

Figures (13)

• Figure 1: An illustration of the life cycle of a host-based cryptojacker.
• Figure 2: A motivating example.
• Figure 3: CryptoGuard system architecture and workflow.
• Figure 4: Percentages of the top 5 most frequently invoked syscalls for 4 different cryptojacker families observed in our experiment.
• Figure 5: Workflow of modules in CryptoGuard Agent.