# Detecting Cryptojacking Web Threats: An Approach with Autoencoders and Deep Dense Neural Networks
## 4 Detecting Browser-Based Cryptojacking and Related Works
Of the hybrid solutions using ML, the former [31] delegates more importance to client-side activity, concentrating its logs on outgoing network packets and subsequently on the effects of malware responses on the CPU, specifically on prolonged power consumption. In turn, the second one [47], is more oriented to handle several elements belonging to the content of the infected sites, which could be a great advantage when trying to categorize the type of cryptojacking families, as it is often performed for phishing menaces in accordance with natural language processing (NLP) methods. Conversely, this would not help in the construction of the dataset, by considering web content in co-occurrence with network and host features, since as a consequence, the dimension of the data could increase, magnifying the risk of misgeneralization and leading to a possibly slower analysis. The third and last one [49] is the only manuscript that applies a similar AE technique, but the pre-processing steps first lie in the operation of a botnet, assuming that cryptojacking attacks are derived from it, and in the course of the tests, the authors refer to shallow algorithms as the machinery for \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Authors** & **ML-Based** & **Algorithm/Technique** & **Type of Threat** & **Type of Defense** \\ \hline [PERSON] et al. [37] & No & Static behavioral signatures, embedded in perimeter security devices & Network traffic traces or binaries datected with cryptomining malware & Hybrid \\ \hline [PERSON] et al. [39] & No & Blacklists, browser behavioral analysis and dynamic content & Web-based cryptojacking & Hybrid \\ \hline [PERSON] et al. [29] & No & Dynamic analysis: blocking of excessive use of resources. Policies: consent of use & Web-based cryptojacking & Host-based \\ \hline [PERSON] et al. [8] & No & WASM fingerprinting & Web-based cryptojacking & Host-based \\ \hline [PERSON] et al. [40] & No & Hybrid analysis: on the static side: SSHP; on the dynamic side: web content analysis & Web-based cryptojacking & Host-based \\ \hline [PERSON] et al. [42] & No & Web crawling + customized regular expressions & Web-based cryptojacking & Host-based \\ \hline [PERSON] et al. [31] & Yes & Content-currency and code-based analysis + Fuzzy C-Means & Web-based cryptojacking & Hybrid \\ \hline [PERSON] et al. [38] & Yes & SVM, Multi-Layer Perceptron(MLP) and RF & Anomalous sites and URLs, related to cryptojacking \& Malicious email attachments & Network-based \\ \hline [PERSON] et al. [43] & Yes & Random Forest (RF) & Web-based cryptojacking & Host-based \\ \hline [PERSON] et al. [44] & Yes & SVM & Web-based cryptojacking & Host-based \\ \hline [PERSON] et al. [47] & Yes & LSTM & Web-based cryptojacking & Hybrid \\ \hline [PERSON] et al. [12] & Yes & RF & Malicious cryptojacking patterns on network traffic & Network-based \\ \hline [PERSON] et al. [48] & Yes & \
\begin{tabular}{l} MISVM, RS + DT (Decision Trees), and SMO + SVM \\ \end{tabular} & Web-based cryptojacking & Host-based \\ \hline [PERSON] et al. [16] & Yes & CNN & Web-based cryptojacking & Host-based \\ \hline [PERSON] et al. [49] & Yes &
\begin{tabular}{l} SVM, RL, and CNN (Convolutional Neutral Network) \\ \end{tabular} & Cryptojacking as part of a botnet & Hybrid \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Related work on detection of cryptojacking and cryptomining threats in the web browser. detection. From this perspective, authors [50] who evaluated a similar threat, but within IoT spoofed nodes, emphasize that the content of the threat, e.g., printable characters, payloads, or encoding, is important for the initial recognition tasks, but not sufficient to assume that a malicious object is identifiable through these factors, since for experienced malicious actors, these are only the vehicle of the attack, and the activity occurs mostly at the client level, at the network layer and the incidents that converge in both.