Detection of unauthorized cryptomining

A non-transitory computer-readable medium storing instructions which, when executed by a processing system of a device including at least one processor, cause the processing system to perform operations, the operations comprising:

• determining an electricity utilization of the device is in excess of an electricity utilization threshold;
• obtaining, in response to the determining, utilization information of the device comprising:
• processor utilization information, memory utilization information, and network utilization information;
• detecting, in response to the obtaining, from the utilization information of the device, a pattern comprising:
• a first network utilization burst, a processor utilization exceeding a processor utilization threshold and a memory utilization exceeding a memory utilization threshold over at least a designated period of time following the first network utilization burst, and a second network utilization burst after at least the designated period of time;
• and
• generating an unauthorized cryptomining alert in response to the detecting the pattern.

A device comprising:

• a processing system including at least one processor;
• and
• a computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising:
• determining an electricity utilization of the device is in excess of an electricity utilization threshold;
• obtaining, in response to the determining, utilization information of the device comprising:
• processor utilization information, memory utilization information, and network utilization information;
• detecting, in response to the obtaining, from the utilization information of the device, a pattern comprising:
• a first network utilization burst, a processor utilization exceeding a processor utilization threshold and a memory utilization exceeding a memory utilization threshold over at least a designated period of time following the first network utilization burst, and a second network utilization burst after at least the designated period of time;
• and
• generating an unauthorized cryptomining alert in response to the detecting the pattern.