The software was developed under the leadership of Alexander Bolshakov, an associate professor at the Information Security Department of MTUCI. The system is based on a mathematical model and architecture designed to identify software that covertly uses computing resources for cryptocurrency mining.
The detection algorithm employs a hybrid approach, combining static, behavioral, and network indicators. To make decisions, the system uses weight coefficients that consider a combination of characteristics of the analyzed process.
A key technical feature is the use of a sliding window and the calculation of a variation coefficient. This mechanism allows the system to distinguish between the load generated by hidden miners and the periodic load created by legitimate system processes.
The product is written in the Golang programming language to ensure high performance and direct access to Linux system interfaces. It interacts with the /proc virtual file system to collect process metrics and integrates with the NVML library to monitor the state of graphics adapters.
The software has received a state registration certificate for computer programs under number RU 2026662200. According to the developers, the tool can serve as an additional security module for Linux-based infrastructures.
