Abstract: Abstract: As the Chinese government continues to regulate cryptocurrency mining activities， miners are increasingly concealing their operations through encryption， proxies， and other methods. Existing mining behavior monitoring techniques have lower accuracy when dealing with covert mining， making effective detection difficult. To address this problem， this paper proposes a covert mining behavior identification method based on RF-Voting. First， we collected and compiled a dataset of covert mining traffic and defined three types of covert mining behaviors. In the feature selection module for covert mining， the RF （Random Forest） feature selector interacts with the Voting classifier to select features， effectively identifying important ones. In the behavior matching module， we propose an enhanced Voting classifier with performance-aware selection and adaptive weight assignment. Performance-aware selection allows for screening high-performance base classifiers， while adaptive weight assignment dynamically adjusts the weights of the classifiers. By combining these two methods， we effectively improve the classification performance and stability of the model. Experimental results show that， compared to traditional mining detection methods， the accuracy of this method was increased by up to 6.18 percentage points， and the F1 score was increased by up to 9.35 percentage points， demonstrating that the RF-Voting method provides a more accurate and effective solution for monitoring covert mining behavior.

Key words: Key words: convert mining, mining behavior, mining traffic, traffic classification, machine learning