Browser-Based Deep Behavioral Detection of Web Cryptomining with CoinSpy
Conor Kelton, Aruna Balasubramanian, Ramya Raghavendra, Mudhakar Srivatsa · 2020
Although the cryptocurrency hype over the past year may be seen by some as a benign social fad, to the Web community it is the center point for a series of ethically dubious ransomware attacks.Browser based cryptomining, or cryptojacking has gained widespread attention.Cryptojacking consists of Web servers delivering cryptocurrency mining scripts to clients, and using the client resources to play part in a distributed coin mining scheme.Although Web server operators defend the ethics of their involvement by quoting mining as a substitute for advertisement revenue, these scripts can hog massive amounts of client-side resources and can be delivered without client consent, presenting a high potential for abuse.Regardless of how ethical these campaigns are, what remains constant is the need for their detection.While there has been an array of work in defending against such cryptojacking campaigns, these defenses remain quite preliminary.We present CoinSpy, an entirely in-browser tool built using deep learning techniques for the detection of cryptomining activity within Web pages.A key challenge is that there is limited visibility into the client resource usage from within the browser sandbox.CoinSpy extracts several signals from information available from the browser and combines them using deep learning to build a powerful cryptojacking classifier.We argue why CoinSpy is the most robust defense against current and future cryptojacking attacks as compared to recent work, and show that it can detect various cryptojacking campaigns with 97% accuracy.