On Detecting Cryptojacking on Websites: Revisiting the Use of Classifiers
Cryptojacking or illegal mining is a form of malware that hides in the victim’s computer and takes the computational resources to extract cryptocurrencies in favor of the attacker. It generates significant computational consumption, reducing the computational efficiency of the victim’s computer. Thi...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-11-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/22/23/9219 |
| _version_ | 1797462199454662656 |
|---|---|
| author | Fredy Andrés Aponte-Novoa Daniel Povedano Álvarez Ricardo Villanueva-Polanco Ana Lucila Sandoval Orozco Luis Javier García Villalba |
| author_facet | Fredy Andrés Aponte-Novoa Daniel Povedano Álvarez Ricardo Villanueva-Polanco Ana Lucila Sandoval Orozco Luis Javier García Villalba |
| author_sort | Fredy Andrés Aponte-Novoa |
| collection | DOAJ |
| description | Cryptojacking or illegal mining is a form of malware that hides in the victim’s computer and takes the computational resources to extract cryptocurrencies in favor of the attacker. It generates significant computational consumption, reducing the computational efficiency of the victim’s computer. This attack has increased due to the rise of cryptocurrencies and their profitability and its difficult detection by the user. The identification and blocking of this type of malware have become an aspect of research related to cryptocurrencies and blockchain technology; in the literature, some machine learning and deep learning techniques are presented, but they are still susceptible to improvement. In this work, we explore multiple Machine Learning classification models for detecting cryptojacking on websites, such as Logistic Regression, Decision Tree, Random Forest, Gradient Boosting Classifier, <i>k</i>-Nearest Neighbor, and XGBoost. To this end, we make use of a dataset, composed of network and host features’ samples, to which we apply various feature selection methods such as those based on statistical methods, e.g., Test Anova, and other methods as Wrappers, not only to reduce the complexity of the built models but also to discover the features with the greatest predictive power. Our results suggest that simple models such as Logistic Regression, Decision Tree, Random Forest, Gradient Boosting, and <i>k</i>-Nearest Neighbor models, can achieve success rate similar to or greater than that of advanced algorithms such as XGBoost and even those of other works based on Deep Learning. |
| first_indexed | 2024-03-09T17:33:06Z |
| format | Article |
| id | doaj.art-a84ff2630b034b349d5bd6a9f232cf70 |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-03-09T17:33:06Z |
| publishDate | 2022-11-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-a84ff2630b034b349d5bd6a9f232cf702023-11-24T12:10:32ZengMDPI AGSensors1424-82202022-11-012223921910.3390/s22239219On Detecting Cryptojacking on Websites: Revisiting the Use of ClassifiersFredy Andrés Aponte-Novoa0Daniel Povedano Álvarez1Ricardo Villanueva-Polanco2Ana Lucila Sandoval Orozco3Luis Javier García Villalba4Department of Computer Science and Engineering, Universidad del Norte, Barranquilla 081007, ColombiaGroup of Analysis, Security and Systems (GASS), Department of Software Engineering and Artificial Intelligence (DISIA), Faculty of Computer Science and Engineering, Office 431, Universidad Complutense de Madrid (UCM), Calle Profesor José García Santesmases 9, Ciudad Universitaria, 28040 Madrid, SpainDepartment of Computer Science and Engineering, Universidad del Norte, Barranquilla 081007, ColombiaGroup of Analysis, Security and Systems (GASS), Department of Software Engineering and Artificial Intelligence (DISIA), Faculty of Computer Science and Engineering, Office 431, Universidad Complutense de Madrid (UCM), Calle Profesor José García Santesmases 9, Ciudad Universitaria, 28040 Madrid, SpainGroup of Analysis, Security and Systems (GASS), Department of Software Engineering and Artificial Intelligence (DISIA), Faculty of Computer Science and Engineering, Office 431, Universidad Complutense de Madrid (UCM), Calle Profesor José García Santesmases 9, Ciudad Universitaria, 28040 Madrid, SpainCryptojacking or illegal mining is a form of malware that hides in the victim’s computer and takes the computational resources to extract cryptocurrencies in favor of the attacker. It generates significant computational consumption, reducing the computational efficiency of the victim’s computer. This attack has increased due to the rise of cryptocurrencies and their profitability and its difficult detection by the user. The identification and blocking of this type of malware have become an aspect of research related to cryptocurrencies and blockchain technology; in the literature, some machine learning and deep learning techniques are presented, but they are still susceptible to improvement. In this work, we explore multiple Machine Learning classification models for detecting cryptojacking on websites, such as Logistic Regression, Decision Tree, Random Forest, Gradient Boosting Classifier, <i>k</i>-Nearest Neighbor, and XGBoost. To this end, we make use of a dataset, composed of network and host features’ samples, to which we apply various feature selection methods such as those based on statistical methods, e.g., Test Anova, and other methods as Wrappers, not only to reduce the complexity of the built models but also to discover the features with the greatest predictive power. Our results suggest that simple models such as Logistic Regression, Decision Tree, Random Forest, Gradient Boosting, and <i>k</i>-Nearest Neighbor models, can achieve success rate similar to or greater than that of advanced algorithms such as XGBoost and even those of other works based on Deep Learning.https://www.mdpi.com/1424-8220/22/23/9219blockchaincryptojackingillegal miningmalwaremachine learning |
| spellingShingle | Fredy Andrés Aponte-Novoa Daniel Povedano Álvarez Ricardo Villanueva-Polanco Ana Lucila Sandoval Orozco Luis Javier García Villalba On Detecting Cryptojacking on Websites: Revisiting the Use of Classifiers Sensors blockchain cryptojacking illegal mining malware machine learning |
| title | On Detecting Cryptojacking on Websites: Revisiting the Use of Classifiers |
| title_full | On Detecting Cryptojacking on Websites: Revisiting the Use of Classifiers |
| title_fullStr | On Detecting Cryptojacking on Websites: Revisiting the Use of Classifiers |
| title_full_unstemmed | On Detecting Cryptojacking on Websites: Revisiting the Use of Classifiers |
| title_short | On Detecting Cryptojacking on Websites: Revisiting the Use of Classifiers |
| title_sort | on detecting cryptojacking on websites revisiting the use of classifiers |
| topic | blockchain cryptojacking illegal mining malware machine learning |
| url | https://www.mdpi.com/1424-8220/22/23/9219 |
| work_keys_str_mv | AT fredyandresapontenovoa ondetectingcryptojackingonwebsitesrevisitingtheuseofclassifiers AT danielpovedanoalvarez ondetectingcryptojackingonwebsitesrevisitingtheuseofclassifiers AT ricardovillanuevapolanco ondetectingcryptojackingonwebsitesrevisitingtheuseofclassifiers AT analucilasandovalorozco ondetectingcryptojackingonwebsitesrevisitingtheuseofclassifiers AT luisjaviergarciavillalba ondetectingcryptojackingonwebsitesrevisitingtheuseofclassifiers |