A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware
Cryptojacking is a type of computer piracy in which a hacker uses a victim’s computer resources, without their knowledge or consent, to mine for cryptocurrency. This is made possible by new memory-based cryptomining techniques and the growth of new web technologies such as WebAssembly, allowing mini...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-02-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/13/4/2039 |
| _version_ | 1797622666190913536 |
|---|---|
| author | Muhammad Haris Khan Abbasi Subhan Ullah Tahir Ahmad Attaullah Buriro |
| author_facet | Muhammad Haris Khan Abbasi Subhan Ullah Tahir Ahmad Attaullah Buriro |
| author_sort | Muhammad Haris Khan Abbasi |
| collection | DOAJ |
| description | Cryptojacking is a type of computer piracy in which a hacker uses a victim’s computer resources, without their knowledge or consent, to mine for cryptocurrency. This is made possible by new memory-based cryptomining techniques and the growth of new web technologies such as WebAssembly, allowing mining to occur within a browser. Most of the research in the field of cryptojacking has focused on detection methods rather than prevention methods. Some of the detection methods proposed in the literature include using static and dynamic features of in-browser cryptojacking malware, along with machine learning algorithms such as Support Vector Machine (SVM), Random Forest (RF), and others. However, these methods can be effective in detecting known cryptojacking malware, but they may not be able to detect new or unknown variants. The existing prevention methods are shown to be effective only against web-assembly (WASM)-based cryptojacking malware and cannot handle mining service-providing scripts that use non-WASM modules. This paper proposes a novel hybrid approach for detecting and preventing web-based cryptojacking. The proposed approach performs the real-time detection and prevention of in-browser cryptojacking malware, using the blacklisting technique and statistical code analysis to identify unique features of non-WASM cryptojacking malware. The experimental results show positive performances in the ease of use and efficiency, with the detection accuracy improved from 97% to 99.6%. Moreover, the time required to prevent already known malware in real time can be decreased by 99.8%. |
| first_indexed | 2024-03-11T09:14:28Z |
| format | Article |
| id | doaj.art-e1d61f5e86dd4750a2f456715f7cf993 |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-11T09:14:28Z |
| publishDate | 2023-02-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-e1d61f5e86dd4750a2f456715f7cf9932023-11-16T18:50:00ZengMDPI AGApplied Sciences2076-34172023-02-01134203910.3390/app13042039A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking MalwareMuhammad Haris Khan Abbasi0Subhan Ullah1Tahir Ahmad2Attaullah Buriro3Department of Computer Science, National University of Computer and Emerging Sciences (NUCES-FAST), Islamabad 44000, PakistanDepartment of Computer Science, National University of Computer and Emerging Sciences (NUCES-FAST), Islamabad 44000, PakistanCenter for Cybersecurity, Brunno Kessler Foundation, 38123 Trento, ItalyFaculty of Computer Science, Free University Bozen-Bolzano, 39100 Bolzano, ItalyCryptojacking is a type of computer piracy in which a hacker uses a victim’s computer resources, without their knowledge or consent, to mine for cryptocurrency. This is made possible by new memory-based cryptomining techniques and the growth of new web technologies such as WebAssembly, allowing mining to occur within a browser. Most of the research in the field of cryptojacking has focused on detection methods rather than prevention methods. Some of the detection methods proposed in the literature include using static and dynamic features of in-browser cryptojacking malware, along with machine learning algorithms such as Support Vector Machine (SVM), Random Forest (RF), and others. However, these methods can be effective in detecting known cryptojacking malware, but they may not be able to detect new or unknown variants. The existing prevention methods are shown to be effective only against web-assembly (WASM)-based cryptojacking malware and cannot handle mining service-providing scripts that use non-WASM modules. This paper proposes a novel hybrid approach for detecting and preventing web-based cryptojacking. The proposed approach performs the real-time detection and prevention of in-browser cryptojacking malware, using the blacklisting technique and statistical code analysis to identify unique features of non-WASM cryptojacking malware. The experimental results show positive performances in the ease of use and efficiency, with the detection accuracy improved from 97% to 99.6%. Moreover, the time required to prevent already known malware in real time can be decreased by 99.8%.https://www.mdpi.com/2076-3417/13/4/2039in-browser cryptojackingcryptominingMonerocryptojacking detectioncryptojacking preventionWASM |
| spellingShingle | Muhammad Haris Khan Abbasi Subhan Ullah Tahir Ahmad Attaullah Buriro A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware Applied Sciences in-browser cryptojacking cryptomining Monero cryptojacking detection cryptojacking prevention WASM |
| title | A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware |
| title_full | A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware |
| title_fullStr | A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware |
| title_full_unstemmed | A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware |
| title_short | A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware |
| title_sort | real time hybrid approach to combat in browser cryptojacking malware |
| topic | in-browser cryptojacking cryptomining Monero cryptojacking detection cryptojacking prevention WASM |
| url | https://www.mdpi.com/2076-3417/13/4/2039 |
| work_keys_str_mv | AT muhammadhariskhanabbasi arealtimehybridapproachtocombatinbrowsercryptojackingmalware AT subhanullah arealtimehybridapproachtocombatinbrowsercryptojackingmalware AT tahirahmad arealtimehybridapproachtocombatinbrowsercryptojackingmalware AT attaullahburiro arealtimehybridapproachtocombatinbrowsercryptojackingmalware AT muhammadhariskhanabbasi realtimehybridapproachtocombatinbrowsercryptojackingmalware AT subhanullah realtimehybridapproachtocombatinbrowsercryptojackingmalware AT tahirahmad realtimehybridapproachtocombatinbrowsercryptojackingmalware AT attaullahburiro realtimehybridapproachtocombatinbrowsercryptojackingmalware |