MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning
Coinhive released its browser-based cryptocurrency mining code in September 2017, and vicious web page writers, called vicious miners hereafter, began to embed mining JavaScript code into their web pages, called mining pages hereafter. As a result, browser users surfing these web pages will benefit...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-09-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/12/19/9838 |
| _version_ | 1797480611993092096 |
|---|---|
| author | Min-Hao Wu Yen-Jung Lai Yan-Ling Hwang Ting-Cheng Chang Fu-Hau Hsu |
| author_facet | Min-Hao Wu Yen-Jung Lai Yan-Ling Hwang Ting-Cheng Chang Fu-Hau Hsu |
| author_sort | Min-Hao Wu |
| collection | DOAJ |
| description | Coinhive released its browser-based cryptocurrency mining code in September 2017, and vicious web page writers, called vicious miners hereafter, began to embed mining JavaScript code into their web pages, called mining pages hereafter. As a result, browser users surfing these web pages will benefit mine cryptocurrencies unwittingly for the vicious miners using the CPU resources of their devices. The above activity, called Cryptojacking, has become one of the most common threats to web browser users. As mining pages influence the execution efficiency of regular programs and increase the electricity bills of victims, security specialists start to provide methods to block mining pages. Nowadays, using a blocklist to filter out mining scripts is the most common solution to this problem. However, when the number of new mining pages increases quickly, and vicious miners apply obfuscation and encryption to bypass detection, the detection accuracy of blacklist-based or feature-based solutions decreases significantly. This paper proposes a solution, called MinerGuard, to detect mining pages. MinerGuard was designed based on the observation that mining JavaScript code consumes a lot of CPU resources because it needs to execute plenty of computation. MinerGuard does not need to update data used for detection frequently. On the contrary, blacklist-based or feature-based solutions must update their blocklists frequently. Experimental results show that MinerGuard is more accurate than blacklist-based or feature-based solutions in mining page detection. MinerGuard’s detection rate for mining pages is 96%, but MinerBlock, a blacklist-based solution, is 42.85%. Moreover, MinerGuard can detect 0-day mining pages and scripts, but the blacklist-based and feature-based solutions cannot. |
| first_indexed | 2024-03-09T22:02:35Z |
| format | Article |
| id | doaj.art-6cd6ffda334d4de1a3c3e1de16d1281c |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-09T22:02:35Z |
| publishDate | 2022-09-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-6cd6ffda334d4de1a3c3e1de16d1281c2023-11-23T19:46:30ZengMDPI AGApplied Sciences2076-34172022-09-011219983810.3390/app12199838MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine LearningMin-Hao Wu0Yen-Jung Lai1Yan-Ling Hwang2Ting-Cheng Chang3Fu-Hau Hsu4Information Engineering College, Guangzhou Panyu Polytechnic, Guangzhou 511400, ChinaDepartment of Computer Science & Information Engineering, National Central University, Taoyuan City 320317, TaiwanDepartment of Applied Foreign Languages, Chung Shan Medical University, Taichung City 40201, TaiwanInformation Engineering College, Guangzhou Panyu Polytechnic, Guangzhou 511400, ChinaDepartment of Computer Science & Information Engineering, National Central University, Taoyuan City 320317, TaiwanCoinhive released its browser-based cryptocurrency mining code in September 2017, and vicious web page writers, called vicious miners hereafter, began to embed mining JavaScript code into their web pages, called mining pages hereafter. As a result, browser users surfing these web pages will benefit mine cryptocurrencies unwittingly for the vicious miners using the CPU resources of their devices. The above activity, called Cryptojacking, has become one of the most common threats to web browser users. As mining pages influence the execution efficiency of regular programs and increase the electricity bills of victims, security specialists start to provide methods to block mining pages. Nowadays, using a blocklist to filter out mining scripts is the most common solution to this problem. However, when the number of new mining pages increases quickly, and vicious miners apply obfuscation and encryption to bypass detection, the detection accuracy of blacklist-based or feature-based solutions decreases significantly. This paper proposes a solution, called MinerGuard, to detect mining pages. MinerGuard was designed based on the observation that mining JavaScript code consumes a lot of CPU resources because it needs to execute plenty of computation. MinerGuard does not need to update data used for detection frequently. On the contrary, blacklist-based or feature-based solutions must update their blocklists frequently. Experimental results show that MinerGuard is more accurate than blacklist-based or feature-based solutions in mining page detection. MinerGuard’s detection rate for mining pages is 96%, but MinerBlock, a blacklist-based solution, is 42.85%. Moreover, MinerGuard can detect 0-day mining pages and scripts, but the blacklist-based and feature-based solutions cannot.https://www.mdpi.com/2076-3417/12/19/9838bitcoinbrowser-based cryptocurrency miningJavaScript minercryptojackingmoneromachine learning |
| spellingShingle | Min-Hao Wu Yen-Jung Lai Yan-Ling Hwang Ting-Cheng Chang Fu-Hau Hsu MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning Applied Sciences bitcoin browser-based cryptocurrency mining JavaScript miner cryptojacking monero machine learning |
| title | MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning |
| title_full | MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning |
| title_fullStr | MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning |
| title_full_unstemmed | MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning |
| title_short | MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning |
| title_sort | minerguard a solution to detect browser based cryptocurrency mining through machine learning |
| topic | bitcoin browser-based cryptocurrency mining JavaScript miner cryptojacking monero machine learning |
| url | https://www.mdpi.com/2076-3417/12/19/9838 |
| work_keys_str_mv | AT minhaowu minerguardasolutiontodetectbrowserbasedcryptocurrencyminingthroughmachinelearning AT yenjunglai minerguardasolutiontodetectbrowserbasedcryptocurrencyminingthroughmachinelearning AT yanlinghwang minerguardasolutiontodetectbrowserbasedcryptocurrencyminingthroughmachinelearning AT tingchengchang minerguardasolutiontodetectbrowserbasedcryptocurrencyminingthroughmachinelearning AT fuhauhsu minerguardasolutiontodetectbrowserbasedcryptocurrencyminingthroughmachinelearning |