# Detecting Cryptojacking Web Threats: An Approach with Autoencoders and Deep Dense Neural Networks
## 5 Proposed Framework
### Data Pre-Processing  
This stage describes the pre-processing of the data, where data cleaning, transformation, and normalization techniques are applied. The process starts with exploratory and cleaning analysis, aiming to impute missing, null, or unprocessable data via last observation carried forward (LOCF) [56], which performs a statistical longitudinal compensation that replaces the errors with the last carried forward observation. The dataset is then subjected to a Z-score normalization process [57], due to the existence of outliers. This is a common phenomenon when converging measurement data from different sources, generating a trend prone to bias-variance effects, such as demonstrated in Table 3. Z-score normalization is denoted in Equation (1). \[X_{zscore}=\frac{X-\mu}{\sigma}, \tag{1}\]  
where \(X\) is the raw dataset, \(\mu\) is the mean, \(\sigma\) is the standard deviation, and \(X_{zscore}\) is the new normalized data. Once the data are normalized, a novel compression and dimensionality reduction technique, namely, the autoencoder [25] is proposed. This is an unsupervised learning algorithm, which uses a backpropagation and compression technique to reconstruct the output as closely as possible to the input of the network, in other words, with a minimum reconstruction error that can be used for feature extraction, with a latent representation of the original characteristics, while minimizing the effects of linearity. AE applications have been successfully applied in cybersecurity areas, as they have in common, the handling of raw and noisy information of web attacks, forensic chains, indicators of compromise, malicious techniques and tactics, and substantially any security disruption event that must be quickly transformed and evaluated. As an example of their application, in [58], two scenarios were selected: network-based anomaly intrusion detection and malware classification. The tests showed rapid progress in detection ratios, without the need for large pre-processing steps. In the same direction, several authors have applied different AE assemblies to improve detection techniques based on anomalies occurring in IoT devices [59], security situation assessment [60], and for cyber-physical system (CPS) environments [61]. Having mentioned the applications of an AE, Figure 4 displays its formal structure. When the AE reconstructs the input, it learns from an identity function that maps the input against the output. Thus, it comprises an input layer (\(L_{1}\)), a hidden layer (\(H_{1}\)) and an output layer (\(O_{1}\)), where the hidden units at \(H_{1}\) layer learn from a dimensionally reduced representation of the input, usually with fewer neurons or units than \(L_{1}\)[62]. In  
Figure 4: Graphical representation of an AE. the encoding phase [63], the compact hidden representation, denoted as vector \(h_{d}\), of the input vector \(x\) with \(d\) characteristics is given by Equation (2). \[h_{d}=f_{\theta(x_{d})}=\gamma_{1}(W_{x_{d}}+b_{1}), \tag{2}\]  
where \(f_{\theta(x_{d})}\) is the mapping function, \(W_{x_{d}}\) is the \(p\times p\) weight matrix with \(p\) hidden units, \(b_{1}\) is the bias vector, \(\theta\) is the parameterized set, and \(\gamma_{1}\) is the encoder activation function. In the decoding phase, the reconstructed vector of dimension \(d\) is calculated by mapping back the compressed hidden representation or vector \(h_{n}\), as shown in Equation (3). \[h_{n}=g_{\theta(h_{d})}=\gamma_{2}(W_{h_{d}}+b_{2}), \tag{3}\]  
where \(g_{\theta(h_{d})}\) is the inverse mapping function, \(\gamma_{2}\) and \(b_{2}\) the decoder activation function and bias, respectively. The optimized mean squared error function is one of the most commonly used loss functions when it comes to AEs to measure the reconstruction error \(L\). Given that \(f_{\theta}:x\to h_{d}\) constructs the input and \(g_{\theta}:h_{d}\to x\) decodes the output, then the error can be minimized as denoted in Equation (4).