# Detecting Cryptojacking Web Threats: An Approach with Autoencoders and Deep Dense Neural Networks
## 6 Results and Discussion  
This section describes the classification results of the SAE + DDNN, to demonstrate the viability of the algorithms presented in this project. For the experimental tests, it was decided to first train an unnormalised set \(X\) directly towards the DDNN algorithm, with raw samples and then by transforming each one, via SAE characterization. Furthermore, using the normalized set \(X_{zscore}\), by feeding raw normalized samples towards the DDNN inputs, and subsequently, by applying the SAE encoder. Both scopes engage training sets \(\{X_{train}\in X\text{ and }X_{train_{z}}\in X_{zscore}\}\) with 80% of random samples without replacement, from which validation subsets \(\{X_{val}\in X_{train}\text{ and }X_{val_{z}}\in X_{train_{z}}\}\) with 20% samples to obtain preliminary metrics in terms of accuracy, during each epoch. In due course, the test subsets are divided \(\{X_{test}\in X,X_{test_{z}}\in X_{zscore}\}\), with 20% of observations for the final DDNN model evaluation. The metrics used to display the performance values are Precision, Recall, and F1 score, as described in Table 6.  
Table 7 shows the results obtained through the above-mentioned data set configurations. Table 7 shows an improvement in pressure for raw \(X_{test}\) and normalized samples \(X_{test_{z}}\) with the SAE + DDNN configuration, with an average score of 99.41% and 90.03%, respectively; however, for raw samples \(X_{test}\), a lower Recall rate, with a value of 24.59% was presented. This is an effect explained in [64], as the reconstruction of the output is facilitated with normalization processes, as it is well known that high variability ensembles are prone to fail when copying the information in the bottleneck layer, that is called as, reconstruction error effect. This problem can be commonly observed by plotting the MSE cost function of the SAE in terms of training data losses versus model validation losses. Two events \begin{table}
\begin{tabular}{c l l} \hline \hline
**Evaluation Metric** & **Description** & **Mathematical Description** \\ \hline \multirow{3}{*}{Precision} & It measures the quality of the model. It is the fraction of relevant observations & \multirow{3}{*}{\(\mathbf{Precision}=\frac{TP}{TP+\mathit{TF}}\)} \\  & relative to the total number of classified instances of benign and cryptojacking & \\ \cline{1-1} \cline{2-3}  & & \\ \hline \multirow{2}{*}{Recall} & Describes the fraction of classified relevant samples out of the total number of & \multirow{2}{*}{\(\mathbf{Recall}=\frac{TP}{TP+\mathit{FN}}\)} \\  & relevant instances. & \\ \hline \multirow{2}{*}{F1-score} & It is the harmonic between Precision and Recall, it measures whether the model & \multirow{2}{*}{\(\mathbf{F}\)-\(\mathbf{1}=2\cdot\frac{\mathbf{Precision}\cdot\mathbf{Recall}}{\mathbf{Precision}+\mathbf{Recall}}\)} \\  & performs as expected, by compensating the \(\mathit{PF}\) and \(\mathit{FN}\) rates. & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Proposed performance metrics. It is important to note that the target class \(1\) is the site infected with cryptojacking, therefore \(TP\) represents the true positives and \(\mathit{FP}\) the false positives. Analogously, the non-target class \(0\) represents the benign sites, of which \(\mathit{TN}\) is identified as the true negatives and \(\mathit{FN}\) as the false negatives, respectively. occur during this representation, when the training set is not sufficiently representative or the validation set presents problems to generalize each sample-characteristic relationship. Both conditions generate a gap in the convergence of the reconstruction of the SAE inputs, causing a decay in the output layer, finally leading to underfitting, as portrayed in Figure 8a. In turn, Figure 8b shows the stability of the losses during training and validation in regard to \(X_{val_{z}}\) and \(X_{train}\) from epoch 80 onwards, where the two are coupled in a constant decrease.