Website Cryptojacking Detection Using Machine Learning : IEEE CNS 20 Poster

Cryptojacking is the process of utilizing one's systems resources without their knowledge to mine cryptocurrency. This can be done by injecting a malicious javascript code into the website. The malicious javascript code injected utilizes system's resources in order to compute hashes.Most of the classic cryptocurrencies such as bitcoin, monero, webchain are built on proof-of-work(pow) algorithm called CryptoNight, which is CPU-bound. They make use of memorybound functions for constructing computational puzzles [1], in order to maximize profit. This total process requires a lot of disc read and write operations. Hence, we have monitored the cache activity to detect whether cryptojacking exists or not. In addition to detection, our method can also detect the CPU percentage throttle set by the attacker making it a multiclass classification problem. We have leveraged a tool called `perf' [2] in order to measure the number of cache hits and misses. Using this methodology, we were able to detect cryptojacking corresponding to each class with an accuracy of 96.25%.