python检测挖矿特征的几种方式

电脑性能上：

①cpu和内存使用率（常见）：

python 实时得到cpu和内存的使用情况方法_python_脚本之家
https://www.jb51.net/article/141835.htm

②c盘剩余容量（有的挖矿程序会占用c盘大量内存）：

Python实现获取磁盘剩余空间的2种方法_python_脚本之家
https://www.jb51.net/article/115604.htm

③直接对已有挖矿进程库进行杀死：

Python3之查看windows下所有进程并杀死指定进程 - Quincy.Coder的博客 - CSDN博客
https://blog.csdn.net/qq_33733970/article/details/80751957

整理并加上其他功能（流量，端口）完成代码如下：

 #!/usr/bin/python3

 # coding:utf-8

 from tkinter import *

 import psutil,linecache,ctypes,wmi

 import os,datetime,time,platform,sys,socket

 def net_is_used(port,ip='127.0.0.1'):#端口检测

     s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

     try:

         s.connect((ip,port))

         s.shutdown(2)

         print('%s:%d is used' % (ip,port))

         return True

     except:

         print('%s:%d is unused' % (ip,port))

         return False

 def get_network_flow(os):#当前流量特征

     if os == "Windows":

         c = wmi.WMI()

         for interfacePerTcp in c.Win32_PerfRawData_Tcpip_TCPv4():

             sentflow = float(interfacePerTcp.SegmentsSentPersec)  #已发送的流量

             receivedflow = float(interfacePerTcp.SegmentsReceivedPersec) #接收的流量

             present_flow = sentflow+receivedflow    #算出当前的总流量

         time.sleep(1)

         for interfacePerTcp in c.Win32_PerfRawData_Tcpip_TCPv4():

            sentflow = float(interfacePerTcp.SegmentsSentPersec)  #已发送的流量

            receivedflow = float(interfacePerTcp.SegmentsReceivedPersec) #接收的流量

            per_last_present_flow = sentflow+receivedflow     #算出1秒后当前的总流量

         present_network_flow = (per_last_present_flow - present_flow)/1024

         return "%.2f"%present_network_flow

 def getMemCpu():

     global n

     data = psutil.virtual_memory()

     total = data.total #总内存,单位为byte

     free = data.available #可以内存

     memory = "Memory usage:%d"%(int(round(data.percent)))+"%\n"#内存使用率

     cpu = "CPU:%0.2f"%psutil.cpu_percent(interval=1)+"%\n"#CPU使用率

     if int(round(data.percent))>75 and psutil.cpu_percent(interval=1) > 75:#挖矿一个特征

         n=1#☆☆☆阈值

     else:

         n=0

     return memory+cpu

 def get_free_space_mb(folder):#C盘内存剩余量

     if platform.system() == 'Windows':

         free_bytes = ctypes.c_ulonglong(0)

         ctypes.windll.kernel32.GetDiskFreeSpaceExW(ctypes.c_wchar_p(folder), None, None, ctypes.pointer(free_bytes))

         return free_bytes.value/1024/1024/1024

     else:

         st = os.statvfs(folder)

         return st.f_bavail * st.f_frsize/1024/1024

 def on_click():#开始检测按钮函数

     global num,n,cont

     os = platform.system()

     label['text'] = '正在检测···'

     info=getMemCpu()

     info = info +"C free space:%0.2f"%get_free_space_mb('C:\\') + "G\n"

     flow=get_network_flow(os)

     if float(flow) > 3000:#病毒一般占用3033KB/s☆☆☆阈值

         n=1

     info = info + "traffic:" + flow + "KB/s"

     conte=linecache.getlines('port.txt')#端口在port文件中

     for i in range(len(conte)):#病毒一般占用4位数端口，端口范围可选，或针对端口关闭

         if net_is_used(int(conte[i])):

             n=1

     #if net_is_used(xxx):xxx为指定端口

     #    n=1

     if get_free_space_mb('C:\\') < 1:

         n=1

     pids = psutil.pids()

     cont=linecache.getlines('process.txt')

     for j in range(len(cont)):

             cont[j]=cont[j][:len(cont[j])-1]

     for pid in pids:

         p = psutil.Process(pid)

         #print(p.name())

         for j in range(len(cont)):

             if p.name() == cont[j]:

                 n=1

     myfile=open('test.txt','a')

     if n==0:

         message['text'] = '本系统现未遭受挖矿攻击\n'+info

         middle=time.strftime('%Y%m%d%H%M',time.localtime(time.time()))+' normal ' + str("%.2f"%get_free_space_mb('C:\\')) + ' ' + flow

         message['bg'] = 'green'

         myfile.write('\n'+middle)

     if n==1:

         message['text'] = '本系统正在遭受挖矿，紧急！\n'+info

         middle=time.strftime('%Y%m%d%H%M',time.localtime(time.time()))+' warning '+ str("%.2f"%get_free_space_mb('C:\\')) + ' ' + flow

         message['bg'] = 'yellow'

         myfile.write('\n'+middle)

     myfile.close()

     label['text'] = '完成检测！'

 def on_click2():#读取日志按钮函数

     label['text'] = '日志读取'

     content=linecache.getlines('test.txt')

     logs=''

     for i in range(len(content)):

         mid=''

         mid=content[i][0:4]+'.'+content[i][4:6]+'.'+content[i][6:8]+' '+content[i][8:10]+':'+content[i][10:]

         logs=logs+mid

     message['text'] = logs

 def on_click3():#重置按钮函数

     message['text'] = ''

     label['text'] = '欢迎使用本反挖矿系统'

     message['bg'] = 'white'

 def on_click4():#杀死文件中进程函数

     global n,cont

     pids = psutil.pids()

     #cont=linecache.getlines('process.txt')

     for pid in pids:

         p = psutil.Process(pid)

         #print(p.name())

         for j in range(len(cont)):

             if p.name() == cont[j]:

                 cmd = 'taskkill /f /t /im '+ '"'+cont[j]+'"'

                 os.system(cmd)

                 message['text'] = '指定文件中进程已清除'

                 message['bg'] = 'green'

 n=0

 root=Tk(className='反挖矿系统')

 root.geometry('400x300')

 label = Label(root)

 label['text'] = '欢迎使用本反挖矿系统'

 message = Label(root,text='')

 label.pack()

 button = Button(root,text='开始使用',command=on_click)

 button.pack()

 button2 = Button(root,text='查看日志',command=on_click2)

 button2.pack()

 button3 = Button(root,text='重置界面',command=on_click3)

 button3.pack()

 button4 = Button(root,text='杀死进程',command=on_click4)

 button4.pack()

 message.pack()

 root.mainloop()