# A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware
## 3 Proposed Approach
\begin{table}
\begin{tabular}{c c c c} \hline
**S.No** & **URL** & **ServiceProvider** & **Keyword** \\ \hline
0 & rugbysearch.co.za & jsecoin & load.jsecoin.com \\ \hline
1 & czh72.com & nerohut & nerohut.com/srv \\ \hline
2 & rafey-cassidy.com & jsecoin & load.jsecoin.com \\ \hline
3 & school-shop.su & coinhive & coinhive.min.js \\ \hline
4 & 24?iphone.co.uk & authedmine & authedmine.min.js \\ \hline \end{tabular}
\end{table} 
Table 2: Example of Some Malicious Domains. Figure 2: Architectural diagram of proposed approach. **Statistical Code Analysis**: In this phase, the source code of the input website is examined to find out if that website communicates with any of the above 14 mentioned unique public mining service providers. If that website turns out to be malicious, it will be blocked from being loaded on the user's machine, else the dynamic analysis is carried out as explained next. **Mining-Code Blocks Identification**: The code blocks are identified, which contain mining-related instructions. In this way, only selected code blocks are extracted for further analysis in the second mode. The entire code is not used in the detection mode because overhead needs to be excluded. If the entire website code was analyzed, processing time would increase heavily, making this protection mechanism not a real-time defensive technique. \begin{table}
\begin{tabular}{c c c c} \hline
**S. No** & **URL** & **Service Provider** & **Keyword** \\ \hline
5 & myweedmarket.com & coinhive & coinhive.min.js \\ \hline
6 & viralrugby.com & coinimp & \_client.start \\ \hline
7 & mistressalanaaradia.com & coinhive & coinhive.min.js \\ \hline
8 & greenheartoc.com & coinhive & coinhive.min.js \\ \hline
9 & intellegration.com & coinimp & \_client.start \\ \hline
10 & my-shopping-list.de & authedmine & authedmine.min.js \\ \hline
11 & arcadianlandscape.com & coinimp & \_client.start \\ \hline
12 & ifixxx.com & coinhive & coinhive.min.js \\ \hline
13 & sto-avtomix.ru & monerise & monerise\_payment\_address \\ \hline
14 & dnd5 spells.rpgist.net & coinimp & \_client.start \\ \hline
15 & tabforcancer.com & coinhive & coinhive.min.js \\ \hline
16 & onkoliki.com & coinhive & coinhive.min.js \\ \hline
17 & tildrakizumab.de & coinhive & coinhive.min.js \\ \hline
18 & 9-journal.com & coinhive & coinhive.min.js \\ \hline
19 & niftybuzz.com & jsecoin & load.jsecoin.com \\ \hline
20 & fhkwindowsanddoor.com & browsermine & bmst.pw \\ \hline \end{tabular}
\end{table} 
Table 2: _Cont._ \begin{table}
\begin{tabular}{c c c} \hline
**S. No** & **Service Provides** & **Keywords** \\ \hline
1 & coinimp & \_client.start \\ \hline
2 & coinhive & coinhive.min.js \\ \hline
3 & jsecoin & load.jsecoin.com \\ \hline
4 & cryptoloot & CRLT.Anonymous( \\ \hline
5 & webminepool & WMP.Anonymous( \\ \hline
6 & browsermine & bmst.pw \\ \hline
7 & wpmonerominer & wp-monero-miner \\ \hline
8 & nerohut & nerohut.com/srv \\ \hline
9 & webminerpool & webmr.js \\ \hline
10 & coinhave & cdn.minescripts.info \\ \hline
11 & deepminer & deepMiner.Anonymous \\ \hline
12 & monerise & monerise\_payment\_address \\ \hline
13 & webmine & webmine.cz \\ \hline
14 & coinnebula & CoinNebula \\ \hline \end{tabular}
\end{table} 
Table 3: Unique Public Service Providers. Thus, it is necessary to keep the processing time as limited as possible. The selected code blocks are identified as possible mining scripts if they have some mining-related properties, such as calculating hashes, etc. **Feature Analysis**: The identified code blocks are measured concerning CPU time. Then, they are compared with the average time calculated from the malicious sample. Different mining service providers are utilized to calculate the baseline value. They are termed malicious if they pass a specified threshold from that average baseline value.