Enhancing GPU Utilization Safety by Detecting Crypto-Mining via Syscall Analysis

Modal has developed a serverless container runtime that allows users to link up to eight NVIDIA GPUs to a function. This capacity, paired with an on-demand billing structure, has attracted crypto-mining abusers who exploit the system by stealing credit card data and monopolizing GPU resources. To combat this, Modal introduced a syscall-based program analysis tool named seccheck, designed to detect and disable malicious cryptomining activities before banning the offending users.

Rethinking Detection Strategies

Initially, Modal's approach to detecting cryptominers relied on an early system that analyzed user metadata. This heuristic rule-based analysis, implemented just hours after the platform's general availability, served as a barrier against abuse but proved insufficient. Abusers can always create deceptive profiles, using IP addresses, emails, and other identifiers to masquerade as legitimate users. While tightening heuristic rules may seem logical, it inevitably increases the false positive rate, leading to potential disruptions for legitimate users.

Analyzing Programs Over Metadata

Recognizing that the effective detection of cryptomining activities necessitates focusing on the mining program itself rather than surrounding metadata, Modal ruled out various detection methods. The complexity of a cryptominer's program far exceeds that of simple spamming scripts, and due to the Python-only SDK of its container runtime—which allows arbitrary x86 Linux code execution—implementing source code or binary analysis was dismissed as impractical. Moreover, traditional container image scanning was not viable, as these functions could download and execute arbitrary programs at runtime.

The solution lies in monitoring system calls, a method that is lightweight and relevant across all x86 programs. Every program requires the kernel to perform almost every operation, so analyzing syscall activity gives insight into potentially malicious behavior.

Identifying Unique Syscall Patterns

When a program interacts with the system, it does so by making system calls (syscalls). For instance, reading or writing a file requires the execution of calls such as open(), read(), and write(). Programs like cryptominers generate unique syscall patterns that can be detected. For example, the Monero proof-of-work program generates numerous syscalls during execution, including those linked to suspicious file paths and network connections known to be associated with mining pools.

Should the initial detection mechanisms allow an abuser through, Modal's engineers can collect syscall logs to enhance future analyses. However, storing all syscall logs by default would generate an immense volume of data, so logs are gathered as needed.

Streamlined Monitoring Processes

Modal avoids the performance pitfalls associated with direct syscall monitoring through the use of strace, which would burden system performance by inserting multiple context switches for every syscall. Instead, Modal employs gVisor, a robust application sandbox that enhances host security and provides syscall isolation. With gVisor, syscalls are intercepted and handled by its own application kernel, significantly reducing the performance overhead linked to syscall tracing.

This architectural choice enables the efficient collection of syscall trace data using dedicated sockets for real-time monitoring. A thread runs continuously for each container, gathering and analyzing syscall events against an evolving set of detection rules.

Focused Detection Rules

Modal's detection system effectively pulls from a limited set of specific syscalls to catch malicious activities, most notably targeting calls that create non-Python subprocesses. For instance, an execve syscall associated with a suspicious program triggers a TaskMessage::SecurityEvent, enabling server-side processes to correlate the event with a user account and decide on immediate action, such as banning a flagged container.

The current implementation has been conservative in its approach, yielding zero false positives thus far, which underscores the system's precision in distinguishing between valid and malicious use cases.

Future Enhancements

The implementation of syscall-based runtime analysis has substantially bolstered Modal’s defenses against cryptomining abuse. Looking ahead, the system can evolve by integrating memory to recognize patterns across multiple syscalls. This flexibility can accommodate changes in abuser tactics, and Modal plans to automate updates to its blacklists for suspicious binaries and IP addresses. Further, exploring rules centered around NVIDIA control commands for GPUs could tighten security against potential exploitations beyond just system calls.

Ultimately, Modal's proactive approach illustrates its commitment to maintaining effective resource allocation while minimizing fraudulent activity, ensuring legitimate users have access to the computational power they require.