MagTracer: Detecting GPU Cryptojacking Attacks via Magnetic Leakage Signals

GPU cryptojacking is an attack that hijacks GPU resources of victims for cryptocurrency mining. Such attack is becoming an emerging threat to both local hosts and cloud platforms. These attacks result in huge economic losses for the victims due to significant power consumption by cryptomining applications. Unfortunately, there are no adequate solutions to detect such attacks. In this paper, we propose MagTracer, a novel GPU cryptojacking detection system that leverages magnetic leakage signals emanating from GPUs. We make a key observation that GPUs emanate a distinct magnetic signal while mining, which can be attributed to the core feature of all cryptomining algorithms (as they are compute-intensive as well as memory-bounded). We design and implement a proof-of-concept detection system to demonstrate MagTracer's feasibility. We evaluate MagTracer on 14 heterogeneous GPU models and achieve a high average true positive rate of over 98% and a low false positive rate below 0.7% in all cases. Furthermore, our comprehensive evaluation confirms that MagTracer is scalable across different mining applications and robust against several targeted attacks.