What Amazon EC2 instance prefix should be monitored to detect potential crypto mining?

Amazon EC2 'P' instances belong to the Accelerated Computing family, which are specifically designed with high-performance Graphics Processing Units (GPUs). Modern cryptocurrency mining algorithms are heavily optimized for the parallel processing capabilities of GPUs, making these instances a primary target for attackers who compromise cloud environments. Monitoring for the unauthorized or anomalous provisioning of 'P' family instances is a critical security measure to detect potential crypto mining abuse. These instances are expensive, and their unexpected usage can be a strong indicator of compromise.

A. C: 'C' instances are Compute Optimized, focusing on high-performance CPUs. While usable for some CPU-based mining, they are less efficient than GPU instances for most modern cryptocurrencies.
C. R: 'R' instances are Memory Optimized. They are designed for memory-intensive applications like databases and are not suitable for the computationally intensive tasks of crypto mining.
D. I: 'I' instances are Storage Optimized, built for workloads requiring high I/O performance to large datasets. They lack the necessary GPU or CPU power for effective mining. ---

1. Amazon Web Services (AWS) Documentation. Amazon EC2 Instance Types. Amazon describes the 'P' instance family as part of "Accelerated Computing," which is "Ideal for machine learning and high performance computing" due to being "powered by NVIDIA GPUs." This hardware is precisely what is targeted for efficient crypto mining. The other instance families (C, R, I) are described with different optimizations (Compute, Memory, Storage) not aligned with mining.

Source: https://aws.amazon.com/ec2/instance-types/ (Accessed under the "Accelerated Computing" section).

2. Amazon Web Services (AWS) Whitepaper. AWS Security Incident Response Guide. This official guide outlines indicators of compromise. In the section "Unauthorized Amazon EC2 instances," it recommends investigating "instance types that are not normally used in your environment (for example, GPU or compute-intensive instance types)." This directly supports monitoring GPU-enabled instances like the 'P' family for security incidents such as crypto mining.

Source: AWS Security Incident Response Guide, June 2023, Page 15, "Indicators of compromise" table.

3. Karim, I., et al. (2022). Cloud-based crypto-jacking: A review and future directions. In Journal of Network and Computer Applications. This peer-reviewed article discusses how attackers exploit cloud resources for illicit crypto mining, specifically noting the targeting of high-performance computing resources. The paper highlights that "attackers often favor instances with powerful GPUs, which are commonly found in accelerated computing families offered by major cloud providers."

DOI: https://doi.org/10.1016/j.jnca.2022.103358 (Section 3.1, "Targeted Cloud Resources").