You Could Be Mine(d): The Rise of Cryptojacking

Carlin, Domhnall; Burgess, Jonah; O’Kane, Philip; Sezer, Sakir

doi:10.1109/msec.2019.2920585

Cited by 27 publications

(20 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A malicious cryptocurrency mining script can be injected into websites in a number of ways [1], [2]: 1) Website Webpage C/C++ WASM Module…”

Section: A Cryptocurrency Mining and Cryptojackingmentioning

confidence: 99%

“…The first component of MINOS is the Wasm Module Auto-Collector. As the user is browsing the Internet, this component checks if the website being visited currently produce any Wasm binaries, and if so, downloads them to a specified folder ( 1 ). The second part is the preprocessor, which reads the specified folder where the Auto-collector downloads the Wasm binaries, and converts each binary in the folder to a gray-scale image ( 2 ).…”

Section: B System Modelmentioning

confidence: 99%

“…The kernel size used in each convolution layer is set to (3,3), while the pool size of each max-pool layer is set to (2,2). These layers are followed by a final dense layer, with the output being an integer representing whether the sample is benign (0) or malicious (1). The trained neural network is fed the transformed data from the preprocessor as input in order to classify the collected Wasm binary as benign or malicious.…”

Section: B System Modelmentioning

confidence: 99%

“…In Line 3, the model.predict_classes() Keras function is used to classify each image in Wasm_images. The function returns an integer representing whether the sample is benign (0) or malicious (1). Each classification result is appended to the results list that the notifier will use to perform its task.…”

Section: Algorithm 2 Outlines the Classify() Function Called Inmentioning

confidence: 99%

“…In recent years, a new type of fileless malware that exploits the computational resources of end-users via browsers, has become increasingly common [1]. This new strain of malware, known as Cryptojacking (a.k.a., drive-by-mining) malware, performs unauthorized and covert cryptocurrency mining operations in browsers without the end-users' knowledge [2].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

MINOS: A Lightweight Real-Time Cryptojacking Detection System

Naseem¹,

Arış²,

Babun³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Emerging WebAssembly(Wasm)-based cryptojacking malware covertly uses the computational resources of users without their consent or knowledge. Indeed, most victims of this malware are unaware of such unauthorized use of their computing power due to techniques employed by cryptojacking malware authors such as CPU throttling and obfuscation. A number of dynamic analysis-based detection mechanisms exist that aim to circumvent such techniques. However, since these mechanisms use dynamic features, the collection of such features, as well as the actual detection of the malware, require that the cryptojacking malware run for a certain amount of time, effectively mining for that period, and therefore causing significant overhead. To solve these limitations, in this paper, we propose MINOS, a novel, extremely lightweight cryptojacking detection system that uses deep learning techniques to accurately detect the presence of unwarranted Wasm-based mining activity in real-time. MINOS uses an image-based classification technique to distinguish between benign webpages and those using Wasm to implement unauthorized mining. Specifically, the classifier implements a convolutional neural network (CNN) model trained with a comprehensive dataset of current malicious and benign Wasm binaries. MINOS achieves exceptional accuracy with a low TNR and FPR. Moreover, our extensive performance analysis of MINOS shows that the proposed detection technique can detect mining activity instantaneously from the most current in-the-wild cryptojacking malware with an accuracy of 98.97%, in an average of 25.9 milliseconds while using a maximum of 4% of the CPU and 6.5% of RAM, proving that MINOS is highly effective while lightweight, fast, and computationally inexpensive. * Minos is the beast in Dante's Divine Comedy that acts as a judge in underworld and decides which layer of the hell the sinner goes to.

show abstract

“…A malicious cryptocurrency mining script can be injected into websites in a number of ways [1], [2]: 1) Website Webpage C/C++ WASM Module…”

Section: A Cryptocurrency Mining and Cryptojackingmentioning

confidence: 99%

Section: B System Modelmentioning

confidence: 99%

Section: B System Modelmentioning

confidence: 99%

Section: Algorithm 2 Outlines the Classify() Function Called Inmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%