How does GCP detect crypto mining within a VM?

4 points by drydenwilliams 330 days ago | 6 comments

Are they noticing this because 100% CPU usage? Or DNS queries from the instances?

This just happened to us and it would be super helpful to know how GCP can scan it before.

Bender 330 days ago |

I do not know the answer specifically as it pertains to GCP but I know that a couple other VPS providers just look for specific programs using a lot of CPU via their command-line and program name from the hypervisor. No scanning, just a process list and CPU usage in those cases. But I have no idea what GCP is specifically doing in your case. Simple monitoring tools can flag this.

mcflubbins 329 days ago | |

> just look for specific programs using a lot of CPU via their command-line and program name from the hypervisor.

They would have to run this from within the guest, no? I don't like the thought of that.

rithdmc 328 days ago |

I've no idea how GCP detect it, though I've read about detection mechanisms profiling the syscalls or CPU signals. Pixie Team posted in 2022 that "RandomX programs are easy to spot. They leverage a large set of CPU features, some of which are rarely used by other programs ... CFROUND changes the rounding mode for floating point operations. Other programs rarely set this mode. When they do, they rarely toggle this value as much as RandomX does"

However, I'd imagine network detection would catch a lot of the larger, automated crypto mining efforts.

pocketsmart 330 days ago |

GCP detects crypto mining in VMs by monitoring unusual resource usage like high CPU or network activity. It analyzes logs for known mining software and suspicious process behavior. Machine learning and threat intelligence help flag abnormal VM activity. Tools like Security Command Center and VPC Flow Logs assist in detection. If mining is detected, GCP alerts the user and may recommend or take action.

chistev 329 days ago | |

AI?

mmarian 330 days ago |

You could look at anomalous ingress/egress patterns.