Browser-Based Deep Behavioral Detection of Web Cryptomining with CoinSpy

Abstract

Although the cryptocurrency hype over the past year may be seen by some as a benign social fad, to the Web community it is the center point for a series of ethically dubious ransomware attacks. Browser based cryptomining, or cryptojacking has gained widespread attention. Cryptojacking consists of Web servers delivering cryptocurrency mining scripts to clients, and using the client resources to play part in a distributed coin mining scheme. Although Web server operators defend the ethics of their involvement by quoting mining as a substitute for advertisement revenue, these scripts can hog massive amounts of client-side resources and can be delivered without client consent, presenting a high potential for abuse. Regardless of how ethical these campaigns are, what remains constant is the need for their detection. While there has been an array of work in defending against such cryptojacking campaigns, these defenses remain quite preliminary. We present CoinSpy, an entirely in-browser tool built using deep learning techniques for the detection of cryptomining activity within Web pages. A key challenge is that there is limited visibility into the client resource usage from within the browser sandbox. CoinSpy extracts several signals from information available from the browser and combines them using deep learning to build a powerful cryptojacking classifier. We argue why CoinSpy is the most robust defense against current and future cryptojacking attacks as compared to recent work, and show that it can detect various cryptojacking campaigns with 97% accuracy.

MINOS: A Lightweight Real-Time Cryptojacking Detection System

“…Bian et al [15] proposed MineThrottle, which uses a block-level profiler and dynamic instrumentation of the Wasm code that is pointed by the profiler at compile time. Kelton et al [19] proposed CoinSpy which utilizes computation, memory, and network features. Conti et al [23] used Hardware Performance Counters (HPC) data to detect cryptojacking.…”

“…However, only a small portion of prior studies [17], [10], [12] take this change into account. Secondly, cryptojacking detection systems [17], [10], [12], [18], [15], [19] relying on dynamic analysis features can suffer from high computational overhead, reduced measurement accuracies due to noise caused by other processes, and false positives resulted from benign websites using the same technologies. For this reason, practical applications of such schemes may cause quality-of-experience issues for end-users.…”

“…SEISMIC [17], MineThrottle [15] and MineSweeper [10] employ code instrumentations. ML models based on a number of dynamic analysis features were utilized by RAPID [18], OUTGUARD [12], and CoinSpy [19]. Conti et al [23] made use of Hardware Performance Counters (HPC) data to detect cryptojacking.…”

“…Most of these techniques are based on the analysis of dynamic features. These include fixed thresholds [16], semantic instruction-count-based signature matching [17], CPU, memory and network traffic features [18], [19], [20], runtime, network, mining-related and browser-based features [12], block-level profiling and dynamic instrumentation [15], [21], [22], hardware performance counters [23], and instructioncount-based analysis and memory events [10]. Although such existing detection systems are promising and report high detection accuracy, there are several issues to consider.…”

Circuit: A JavaScript Memory Heap-Based Approach for Precisely Detecting Cryptojacking Websites

“…Existing cryptojacking detection approaches mainly use the following four techniques: blacklisting-based [14], [16], [25], [37], [42], [45], resource monitoring-based [38], [40], thread count-based [38], [41], and WebAssembly-based techniques [35], [42]. Although they all provide insights into detecting cryptojacking, they have limitations in terms of the precise detection of cryptojacking.…”