In view of the fact that the current domestic hidden mining activities are mainly based on encrypted traffic, and it is impossible to directly discover the relevant characteristics of encrypted mining pools from message traffic analysis, a method for discovering encrypted mining pools or proxy nodes based on network traffic detection and analyzing their key characteristics is proposed. By simulating the actual mining traffic of encrypted miners, a variety of specific traffic is injected into the encrypted mining pool or proxy node. By integrating network security monitoring, blockchain data analysis and other technical means, the encrypted mining pool or proxy node based on the mainstream mining pool protocol is quickly discovered. In addition, a currency feature recognition model for encrypted mining pools and feature recognition of encrypted mining pools are established to accurately extract and analyze the image features of encrypted mining pools, including the pool's certificate, currency, name, wallet address and other feature information. At the same time, combined with the encrypted mining pool information discovered by the above method, the IQR algorithm based on time series is used to identify the actual mining traffic in the known peer encrypted mining pool. Experimental results show that this technology can effectively identify different mining pool protocols and corresponding portrait features. The recognition accuracy of the currency features of the encrypted mining pool exceeds 97%. At the same time, it can more accurately identify the mining traffic of the known peer as the encrypted mining pool node, providing an efficient technical means to distinguish mining traffic in actual network monitoring.