# A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware
## 3 Proposed Approach  
The complete lifecycle of this malware is shown in Figure 1. The attacker injects the malicious cryptojacking malware script into a website. Either the website is owned by the attacker or a website owned by someone else is compromised so that the payload can be embedded into it. The user requests that the malicious website and the website, along with the script, be loaded on the client side, i.e., the user's laptop, desktop, etc. The script gets executed and communicates with a mining service provider. The script will ask for a mining task. The service provider will assign it a mining task to perform cryptomining for some specified cryptocurrencies such as Monero, etc. The script will execute that task on the client side. Cryptomining will start at the user's end using the user's computational resources. The results of the mining process will be sent to the service provider. Finally, these results will be forwarded to the attacker who created the mining script. In this way, the attacker could use the victim's resources without the consent and knowledge of that victim. Figure 2 shows the architectural diagram of our proposed approach. In addition to the dynamic approach of extracting features such as CPU behavior, this methodology introduces a static malware analysis technique, thus deploying a hybrid defensive mechanism. When the user visits any website, before conducting the dynamic analysis of that website, this approach compares the URL of that website with an existing blacklist containing the URLs of already detected in-browser cryptojacking malware. This technique will check whether that website's URL is in that blacklist. If yes, the website will be blocked immediately, thus saving a lot of computational resources and time as there is no need to conduct the dynamic analysis. On the other hand, if the website's URL is not present, then static code analysis will be conducted, and the URL will be blocked if detected as malicious; else, the dynamic analysis will be performed. The interpreting mode will identify malicious code blocks, the detection mode will measure the CPU time of that code block and compare it against the average CPU time of cryptojacking malware, and finally, the defense mode will suspend it if found to be malicious. Figure 1: Lifecycle of In-browser Cryptojacking. Following is a brief description of the various modules of our proposed approach. **Blacklist:** The blacklist used for detecting cryptojacking malware is used by [PERSON] et al. [14] in their research. It consists of the URLs of malicious domains/websites which perform cryptojacking. The corresponding public service provider was mentioned along with their domain name. Moreover, the associated keywords were provided to find the publicly known service provider and their user domains in PublicWWW. It should be noted that it may be possible for some malicious domains to utilize more than one service provider for the cryptojacking attack. Table 2 shows some malicious domains, their service providers, and associated keywords. In general, 14 unique publicly known service providers were used to generate this blacklist. Some famous service providers are service providers such as Coinhive and Cryptoloot. Other service providers are less frequently used but still active. Table 3 shows all the unique service providers and their associated keywords. The dataset presented by [PERSON] et al. [14] used the blacklists of previous studies. As some of these blacklists were not regularly updated, the dataset was verified and filtered so that the final dataset consists of 1273 malicious cryptojacking-infected websites. The blacklist contains the URLs of those infected websites. The last time these websites were verified to contain cryptojacking malware was on 24 July 2022.