# Detecting Cryptojacking Web Threats: An Approach with Autoencoders and Deep Dense Neural Networks
## 5 Proposed Framework
### Data Collection  
The data collection process starts with fingerprinting, which is a well-known initial detection process that correlates different data, versions, services, and some patterns when performing penetration testing (pentesting) tasks. In this case, cryptojacking, being a threat that resides mainly on websites, goes through an exploration process similar to phishing, with particular aspects that are listed below:  
* Cybercriminals can create instances of illegal cryptocurrency mining within a few lines of source code in a script, which can slow down the fingerprint search based on simple text queries towards a broad set of websites. This also tends to happen when the script is part of another vulnerability exploit and the attacker attempts to encode or encrypt the lines in other schemes, to evade defenses. * Often, malicious sites redirect requests within HTTP headers, negatively affecting the responses when capturing client-server bidirectional transfer of information. The answer is simple: if a traditional fingerprinting scope is set via web crawling, it may fail to properly follow the responses, as it may only return the first and not the forwarding paths. Some attackers time the loading of HTML or add dynamic content presentation mechanisms to avoid content query automation techniques. Other malicious actors add riddles, bogus captchas, or shorteners that only by constant human interaction will reveal the final destination. For this reason, an analysis of data congregation between layers is proposed as shown in Figure 3. Each layer is described below:  
* _Layer 1--Fingerprinting_: in this initial layer, sites that may contain signs of cryptonining are captured. This stage is vital as it filters out those that will be useful for exploration and eventual characterization, discarding inappropriate storage of unwanted, duplicated, or error-coded sites. * _Layer 2--Network-based data_: comprises the information flows of traffic transiting through the HTTP/s and TCP protocols. This allows the analysis of request-response patterns in site activity and tracking nested scripts on the site. * _Layer 3--Host-based data_: is the monitoring of the website once it interacts with the browser. In this step, the activities of the web browser are implemented through an application that resembles human navigation, leaving aside the complications of a classic web crawler. Attention is paid to the actions that are triggered once the content is rendered and consequently the behaviors that are directed towards the CPU and  
Figure 2: Workflow of the proposed methodology. the processes that are activated for resource consumption. At this stage, suspicious samples that are not detected in the previous ones, due to their obfuscated or coded form, can be revealed. To run the instances for fingerprinting, analysis, network monitoring, and capture of host activity, a virtual environment was configured, with the following characteristics: two virtual machines (VMs) with Ubuntu 16.04 and Windows 10 operating systems, both with an Intel Core i7 processor and 16 GB of RAM. For HTTP crawling and TCP processing, native parsing libraries were used by means of Python 3.7 programming language. For its part, Selenium [53] web instrumentation tool served as the action automaton of the fingerprinted sites, which inherently contains Chrome as the browser that resembles the human-oriented navigation activity. In order to select the necessary sites to be crawled, dumps of databases with previously identified malware, were appended: firstly, the NoCoin adblock list [52], which is a series of 642 URLs with regular expressions, containing traces of common web-based cryptojacking families. It is actively handled to complement extensions such as AdBlock, uBlock Origin, and AdGuard; also conforming a native component of web browser policies such as Brave and Opera.