python检测挖矿特征的几种方式

电脑性能上：

①cpu和内存使用率（常见）：

python 实时得到cpu和内存的使用情况方法_python_脚本之家
https://www.jb51.net/article/141835.htm

②c盘剩余容量（有的挖矿程序会占用c盘大量内存）：

Python实现获取磁盘剩余空间的2种方法_python_脚本之家
https://www.jb51.net/article/115604.htm

③直接对已有挖矿进程库进行杀死：

Python3之查看windows下所有进程并杀死指定进程 - Quincy.Coder的博客 - CSDN博客
https://blog.csdn.net/qq_33733970/article/details/80751957

整理并加上其他功能（流量，端口）完成代码如下：

#!/usr/bin/python3
# coding:utf-8
from tkinter import *
import psutil,linecache,ctypes,wmi
import os,datetime,time,platform,sys,socket

def net_is_used(port,ip='127.0.0.1'):#端口检测
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    try:
        s.connect((ip,port))
        s.shutdown(2)
        print('%s:%d is used' % (ip,port))
        return True
    except:
        print('%s:%d is unused' % (ip,port))
        return False

def get_network_flow(os):#当前流量特征
    if os == "Windows":
        c = wmi.WMI()
        for interfacePerTcp in c.Win32_PerfRawData_Tcpip_TCPv4():
            sentflow = float(interfacePerTcp.SegmentsSentPersec)  #已发送的流量
            receivedflow = float(interfacePerTcp.SegmentsReceivedPersec) #接收的流量
            present_flow = sentflow+receivedflow    #算出当前的总流量
        time.sleep(1)
        for interfacePerTcp in c.Win32_PerfRawData_Tcpip_TCPv4():
           sentflow = float(interfacePerTcp.SegmentsSentPersec)  #已发送的流量
           receivedflow = float(interfacePerTcp.SegmentsReceivedPersec) #接收的流量
           per_last_present_flow = sentflow+receivedflow     #算出1秒后当前的总流量
        present_network_flow = (per_last_present_flow - present_flow)/1024
        return "%.2f"%present_network_flow

def getMemCpu():
    global n
    data = psutil.virtual_memory()
    total = data.total #总内存,单位为byte
    free = data.available #可以内存
    memory = "Memory usage:%d"%(int(round(data.percent)))+"%
"#内存使用率
    cpu = "CPU:%0.2f"%psutil.cpu_percent(interval=1)+"%
"#CPU使用率
    if int(round(data.percent))>75 and psutil.cpu_percent(interval=1) > 75:#挖矿一个特征
        n=1#☆☆☆阈值
    else:
        n=0
    return memory+cpu

def get_free_space_mb(folder):#C盘内存剩余量
    if platform.system() == 'Windows':
        free_bytes = ctypes.c_ulonglong(0)
        ctypes.windll.kernel32.GetDiskFreeSpaceExW(ctypes.c_wchar_p(folder), None, None, ctypes.pointer(free_bytes))
        return free_bytes.value/1024/1024/1024
    else:
        st = os.statvfs(folder)
        return st.f_bavail * st.f_frsize/1024/1024

def on_click():#开始检测按钮函数  
    global num,n,cont
    os = platform.system()
    label['text'] = '正在检测···'
    info=getMemCpu()
    info = info +"C free space:%0.2f"%get_free_space_mb('C:\') + "G
"
    flow=get_network_flow(os)
    if float(flow) > 3000:#病毒一般占用3033KB/s☆☆☆阈值
        n=1
    info = info + "traffic:" + flow + "KB/s"
    conte=linecache.getlines('port.txt')#端口在port文件中
    for i in range(len(conte)):#病毒一般占用4位数端口，端口范围可选，或针对端口关闭
        if net_is_used(int(conte[i])):
            n=1
    #if net_is_used(xxx):xxx为指定端口
    #    n=1
    if get_free_space_mb('C:\') < 1:
        n=1
    pids = psutil.pids()
    cont=linecache.getlines('process.txt')
    for j in range(len(cont)):
            cont[j]=cont[j][:len(cont[j])-1]
    for pid in pids:
        p = psutil.Process(pid)
        #print(p.name())
        for j in range(len(cont)):
            if p.name() == cont[j]:
                n=1
    myfile=open('test.txt','a')
    if n==0:
        message['text'] = '本系统现未遭受挖矿攻击
'+info
        middle=time.strftime('%Y%m%d%H%M',time.localtime(time.time()))+' normal ' + str("%.2f"%get_free_space_mb('C:\')) + ' ' + flow
        message['bg'] = 'green'
        myfile.write('
'+middle)
    if n==1:
        message['text'] = '本系统正在遭受挖矿，紧急！
'+info
        middle=time.strftime('%Y%m%d%H%M',time.localtime(time.time()))+' warning '+ str("%.2f"%get_free_space_mb('C:\')) + ' ' + flow
        message['bg'] = 'yellow'
        myfile.write('
'+middle)
    myfile.close()
    label['text'] = '完成检测！'

def on_click2():#读取日志按钮函数
    label['text'] = '日志读取'
    content=linecache.getlines('test.txt')
    logs=''
    for i in range(len(content)):
        mid=''
        mid=content[i][0:4]+'.'+content[i][4:6]+'.'+content[i][6:8]+' '+content[i][8:10]+':'+content[i][10:]
        logs=logs+mid
    message['text'] = logs

def on_click3():#重置按钮函数
    message['text'] = ''
    label['text'] = '欢迎使用本反挖矿系统' 
    message['bg'] = 'white'

def on_click4():#杀死文件中进程函数
    global n,cont
    pids = psutil.pids()
    #cont=linecache.getlines('process.txt')
    for pid in pids:
        p = psutil.Process(pid)
        #print(p.name())
        for j in range(len(cont)):
            if p.name() == cont[j]:
                cmd = 'taskkill /f /t /im '+ '"'+cont[j]+'"'
                os.system(cmd)
                message['text'] = '指定文件中进程已清除'
                message['bg'] = 'green'

n=0
root=Tk(className='反挖矿系统')
root.geometry('400x300')
label = Label(root)  
label['text'] = '欢迎使用本反挖矿系统'  
message = Label(root,text='')   
label.pack() 
button = Button(root,text='开始使用',command=on_click)
button.pack() 
button2 = Button(root,text='查看日志',command=on_click2)  
button2.pack() 
button3 = Button(root,text='重置界面',command=on_click3)  
button3.pack()
button4 = Button(root,text='杀死进程',command=on_click4)  
button4.pack()
message.pack()
root.mainloop()