# Detecting Cryptojacking Web Threats: An Approach with Autoencoders and Deep Dense Neural Networks
## 7 Conclusions  
Cryptojacking is a stealthy threat that constantly affects users, who without realizing it, fall under the traps of malicious actors, who wait to consume the victim's resources without warning, in order to mine illicit operations towards a PoW. This paper proposes an ML \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Algorithms** & \(\mathbf{\lambda^{*}}\) & **Precision** & **Recall** & **F1-Score** & **Training Time (hms)** \\ \hline Fuzzy C-Means [31] & \(m=1.5\) & 95.71\% & 29.30\% & 42.30\% & 00:02:15 \\ \hline SVM [38; 44] & \(C=10,div=\text{One-vs-rest}\) and \(ker=\text{RBF}\) & 72.47\% & 100.00\% & 84.04\% & 0.17:11 \\ \hline MLP [38] & \(H_{1}\in\mathbb{R}^{23},act=\text{Sigmoid}\) and \(sol=\text{ADAM}\) & 92.90\% & 92.62\% & 92.32\% & 00:01:25 \\ \hline RF [12; 38; 43] & \(asm=\text{GINL},mdt=5,\text{s},\text{r}fBS=9,\text{rmsLN}=17,\text{rmsLN}=8 \text{and}\,mTT=4\) & 94.67\% & 93.56\% & 93.74\% & 00:03:21 \\ \hline MISVM [48] & \(C=10,ker=\text{RBF}\) and \(nb=100\) & 96.38\% & 76.03\% & 85.01\% & 00:29:37 \\ \hline RS + DT [48] & \(trcs=4\) and \(mmF=4\) & 94.09\% & 87.87\% & 90.38\% & 00:02:27 \\ \hline SMO + SVM [48] & \(C=1\) and \(ker=\text{RBF}\) & 69.79\% & 61.39\% & 65.11\% & 00:31:43 \\ \hline RL [49] & \(C=0.9,opt=\text{LBFGS}\) and \(\ell_{a}=\ell_{2}\) & 99.13\% & 98.00\% & 98.57\% & 00:01:45 \\ \hline CNN [16; 49] & n/a & 86.41\% & 83.23\% & 80.48\% & 00:07:55 \\ \hline LSTM [47] & n/a & 81.22\% & 51.34\% & 50.65\% & 00:04:22 \\ \hline This work (SAE + DDNN) & n/a & 99.41\% & 99.11\% & 99.26\% & 00:01:27 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Comparison of state-of-the-art results after applying the grid search method. A significant performance improvement can be noted in the proposed SAE + DDNN technique. based solution that employs a holistic view of cryptojacking, concentrating its effort on two major attack surfaces: the network, which is the entry point of the threat, and the host, which is where the malware payload is executed and disseminated. Considering the sophistication of several new strains, it is possible to characterize cryptojacking appropriately utilizing host and network features. To achieve this goal, it was first proposed a traversal web crawl towards possibly infected websites to perform the well-known fingerprinting process, using statistical comparison techniques. This reduces the dimensional size of the dataset and helps to follow a line of recognition similar to pentesting tests. This made it possible to analyze important sites and rule out several false positives or URLs with inaccessibility codes. Each site was subjected to a controlled environment that demonstrated that it is possible to capture evidence of cryptojacking by presenting activity on the network and within the victim's operating system once the attack is triggered. To represent the most important information, a novel feature extraction and selection technique called SAE was employed, which reduces dimensionality while retaining the best latent data for variant inputs such as those in the proposed dataset. The compressed and normalized outputs fed a DDNN, which, thanks to its deep design, allowed higher performance rates, compared to other state-of-the-art works, with a shorter training time. The values included are, for Precision 99.41%, for Recall 99.10%, and for F1 score 99.25%, with an approximate training time of one minute and twenty seconds. With the detailed metrics, one could recommend the development of detection tools at the browser level or as an addition to antivirus systems or industrial devices such as IPS and IDS, however, it must also be considered that there are limitations to carry them out, which are addressed in two key points of improvement. Firstly, it will be necessary to compile the model in such a way that a baseline detection with a sensing agent can recognize and classify the samples, to produce an alert or trigger a mitigation/remediation policy over minimal or restricted environments.