用于基于主机的加密劫持恶意软件检测的视觉转换器框架
Vision transformer framework for host based cryptojacking malware detection.
摘要(中文译文)
加密货币的日益普及伴随着挖矿劫持恶意软件的兴起，此类恶意软件秘密劫持计算资源进行未经授权的加密货币挖矿。这一威胁不仅降低系统性能并造成经济损失，而且日益规避传统入侵检测系统（IDS），后者通常存在准确性有限、误报率高以及在实时或资源受限环境中适应性差等问题。为克服这些局限性，本研究提出CryptoIDS-ViT，一种先进的IDS框架，采用视觉Transformer架构，即ViT、MaxViT和SwinViT，用于稳健的基于主机的挖矿劫持检测。本工作的意义在于对准确缓解挖矿劫持的需求日益增长，以及引入了一种新颖的端到端检测框架，将基于Transformer的模型适配到安全关键领域。该方法的新颖性源于其基于图像的恶意软件表示流水线，其中可执行二进制文件被系统地转换为彩色和灰度图像，以及对多个预训练Transformer模型进行定制适配和比较基准测试以检测挖矿劫持攻击——这是一个尚未充分探索且新兴的网络安全挑战。涉及深度特征提取和分类的两阶段过程实现了具有高泛化性的准确检测。在包含40,000个样本（20,000个挖矿劫持、20,000个良性）的平衡数据集上进行的大量评估证明了优越性能：SwinViT模型在彩色图像上达到99.35%的准确率，在灰度图像上达到99.08%，精确率为99.41%，召回率为99.27%，F1分数为99.34%。与最先进的基于CNN的IDS相比，CryptoIDS-ViT在检测指标上提升了3-4%，同时保持实时推理效率。其他贡献包括：（i）针对恶意软件特征提取定制的二进制到图像编码策略，（ii）ViT注意力热图可视化，增强可解释性和模型透明度，（iii）评估输入模态效应（彩色与灰度）的消融研究，以及（iv）支持边缘或企业系统部署可行性的运行时和内存复杂度分析。这些结果验证了所提出框架在输入类型和部署环境间的泛化能力，确立了基于ViT的IDS作为在现代网络安全基础设施中检测复杂挖矿劫持恶意软件的可扩展、可解释且实用的解决方案。与将ViT应用于通用恶意软件分类的现有研究不同，本工作为检测基于主机的挖矿劫持威胁做出了聚焦、经过充分评估且具有高影响力的贡献。
Abstract
The rising adoption of cryptocurrencies has been paralleled by the emergence of cryptojacking malware, malicious software that covertly hijacks computing resources for unauthorized cryptocurrency mining. This threat not only degrades system performance and incurs financial losses but also increasingly evades traditional intrusion detection systems (IDSs), which often suffer from limited accuracy, high false positive rates, and poor adaptability in real-time or resource-constrained environments. To overcome these limitations, this study proposes CryptoIDS-ViT, an advanced IDS framework that employs vision transformer architectures, namely ViT, MaxViT, and SwinViT, for robust host-based cryptojacking detection. The significance of this work lies in both the growing need for accurate cryptojacking mitigation and the introduction of a novel end-to-end detection framework that adapts transformer-based models to a security-critical domain. The novelty of the approach stems from its image-based malware representation pipeline, where executable binaries are systematically transformed into both color and grayscale images, and from the custom adaptation and comparative benchmarking of multiple pretrained transformer models for detecting cryptojacking attacks, an underexplored and emerging cybersecurity challenge. A two-stage process involving deep feature extraction and classification enables accurate detection with high generalizability. Extensive evaluation on a balanced dataset of 40,000 samples (20,000 cryptojacking, 20,000 benign) demonstrates superior performance: the SwinViT model achieves 99.35% accuracy on color images and 99.08% on grayscale, with a precision of 99.41%, recall of 99.27%, and F1-score of 99.34%. Compared to state-of-the-art CNN-based IDSs, CryptoIDS-ViT delivers a 3-4% improvement in detection metrics while preserving real-time inference efficiency. Additional contributions include: (i) a custom binary-to-image encoding strategy tailored to malware feature extraction, (ii) ViT attention heatmap visualizations that enhance interpretability and model transparency, (iii) an ablation study evaluating input modality effects (color vs. grayscale), and (iv) a runtime and memory complexity analysis supporting deployment feasibility in edge or enterprise systems. These results validate the proposed framework's capability to generalize across input types and deployment contexts, establishing ViT-based IDSs as a scalable, interpretable, and practical solution for detecting sophisticated cryptojacking malware in modern cybersecurity infrastructures. Unlike existing studies that apply ViTs to general malware classification, this work delivers a focused, thoroughly evaluated, and high-impact contribution to the detection of host-based cryptojacking threats.
如何引用
AMA
Walid El-Shafai, Ahmad Taher Azar, Samah Alshathri. Vision transformer framework for host based cryptojacking malware detection.. Scientific reports. 2026; doi:10.1038/s41598-025-14378-1.
APA
Walid El-Shafai, Ahmad Taher Azar, Samah Alshathri (2026). Vision transformer framework for host based cryptojacking malware detection.. Scientific reports. https://doi.org/10.1038/s41598-025-14378-1
GB/T 7714
Walid El-Shafai, Ahmad Taher Azar, Samah Alshathri. Vision transformer framework for host based cryptojacking malware detection.[J]. Scientific reports, 2026 doi:10.1038/s41598-025-14378-1.
在 PubMed增强版 阅读全文
翻译全文 · AI 文献问答 · PDF 原文下载 · 引用导出