# A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware
## 1 Introduction  
With the advancement of technology, humans have started finding new secure ways to transfer money online, leading them to the development of blockchain. The first blockchain application, Bitcoin, was created in 2009 by [PERSON] [1]. Since then, many other cryptocurrencies have been developed [2], with over 2000 existing today [3]. Cryptocurrency eliminates the need for centralized management and maintains user privacy through decentralized systems and consensus algorithms such as \"Proof of Work (PoW)\", which requires solving a complex mathematical task to verify transactions. This process is known as cryptomining or simply mining, and the person who solves the puzzle is called a miner [4]. Mining normally requires high computational resources and hence relies on more advanced equipment (requiring expensive hardware) to help earn mining awards [5]. Thus, hackers have employed a technique called cryptojacking [6] to earn mining rewards without spending money on buying such advanced machines. This malware is used to utilize the resources of other people's computers, mobiles, and devices without their consent, allowing the hacker to mine cryptocurrency without the victims' permission, saving the expense ofbuying advanced computational machines. Cryptojacking malware attacks became more prevalent after 2017 and have continued to emerge since then [7]. In-browser cryptojacking has recently gained exponential growth and thus has attracted security researchers' attention, from both industry and academia, to find efficient approaches to detect this malware [8]. In addition to the detection work by [PERSON] et al. [9], some researchers discuss the prevention methodology to mitigate the cryptojacking attack. The study by [PERSON] et al. [10] detects the malicious script of cryptojacking by measuring the CPU usage and notifying the user in case of some malicious script in the background of the website. The method presented by [PERSON] and [PERSON] [11] kills the malicious process after detecting it by comparing it with the blacklist items. Another approach by [PERSON] et al. [12] suspends the execution of the script if detected as malicious. The existing approaches are effective only in detecting in-browser cryptojacking if it has web-assembly (WASM) code instructions [13]. Hence, the malware developed in other languages, such as JavaScript and advanced obfuscation techniques, are not detected. A solution to this problem may include checking the website against a blacklist of already identified web-based cryptojacking malware. The proposed approach in this paper is a novel hybrid method for in-browser malware detection and prevention. It combines dynamic and static malware analysis techniques by first comparing the URL of a website visited by a user to an existing blacklist of in-browser cryptojacking malware URLs. The website is blocked immediately if the URL is present on the blacklist. Otherwise, it undergoes a static code analysis, and if found to be malicious, it is blocked. If not, a dynamic analysis is performed. The approach includes an interpreting mode to identify malicious code blocks, a detection mode to measure the CPU time of the code block, and a defense mode to suspend it if malicious. The proposed solution allows for flexible suspension intervals for malicious code blocks based on the confidence level. The approach has an overall accuracy of 99.6% on a dataset of 1000 samples and a low-performance overhead, with an increase of only 7% compared to a dynamic analysis alone. It is suitable to be run in real-time systems. The main contributions of this work are the following:  
* The proposal of a novel hybrid approach--combining blacklisting detection (as the 1 st), signature-based detection (as the 2 nd), and a dynamic approach (as the 3 rd) defensive layer. * The advancement of the state of the art in terms of the detection accuracy (from 97% to 99.6%). * An extension of the malware protection to non-WASM cryptojacking. The rest of this paper is organized as follows.