# A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware
## 5 Experimental Evaluation
### Discussion  
The proposed methodology is supposed to overcome the limitation of the state-of-the-art approach, which in this is to extend the detection and prevention of in-browser cryptojacking attacks from WASM modules only to both WASM and non-WASM code instructions. By looking at Table 4, it can be analyzed that the proposed solution was able to detect malicious websites better than the previous method presented by [PERSON] et al. [12]. The accuracy has improved from 97.6% to 99.6%. Moreover, the false negative rate has reduced from 60% to 10%. The experiments were also performed on a larger dataset with 1000 instances containing 30 malicious instances to make the results more reliable. The state-of-the-art approach achieved an accuracy of 97.5%, while the proposed approach achieved an accuracy of 99.4%. All these evaluation metrics show that this proposed methodology is more accurate while detecting malicious samples with a maximum performance overhead of 10.7%. This is because the proposed methodology can detect non-WASM service providers' scripts and detect WASM code blocks only. Thus, the results confirm that the research gap in the state-of-the-art work has been solved efficiently. The experiments show that the proposed approach can efficiently detect and prevent in-browser  
Figure 4: Performance Comparison between Static and Dynamic Approaches.  
Figure 5: Execution Time in Percentage for Static and Dynamic Approaches.  
cryptojacking attacks in real time. It has achieved an accuracy of 99.6% with a low false negative result of only 13.3%. Moreover, integrating the static and dynamic analyses has increased the performance overhead by only 10.7% for the worst scenario. All these metrics show that the proposed approach is a suitable defense against in-browser cryptojacking attacks. Below is a comparison of this approach with the previous works.  
Comparison with the State of the Art  
As it can be seen from Table 1, many papers do focus on the detection of in-browser cryptojacking attacks only. Work presented by [PERSON] et al. [26] has achieved a precision rate of 100% but is focused only on detection. Other hybrid approaches such as that of [PERSON] et al. [33] achieved an F1 score of 99.25% but still lack a prevention procedure. The work presented by [PERSON] et al. [10] focuses on preventing cryptojacking attacks but uses only 100 input samples. Moreover, its prevention technique is limited to only notifying the user. Another hybrid preventive technique is that of [PERSON] and [PERSON] [11]. It successfully blocks the malicious input, but no results were included in their paper, and thus no comparison can be made. The work presented by [PERSON] et al. [12] is the closest work to ours, and thus, we implemented their work and used the same dataset as used for our work. It turned out that for the same dataset, [12] achieved an accuracy of 97%, while our work achieved an accuracy of 99.6%. Thus, our work out-stands the state-of-the-art work in preventing in-browser cryptojacking malware by 2.6%. This is because the proposed methodology can detect non-WASM service providers' scripts along with WASM-based cryptojacking scripts, while [12] can detect WASM code blocks only. Thus, the results confirm that the research gap in the state-of-the-art work has been solved efficiently.