# Detecting Cryptojacking Web Threats: An Approach with Autoencoders and Deep Dense Neural Networks
## 5 Proposed Framework
### Deep Dense Neural Networks  
Dense neural networks are an architecture of deep, biologically inspired models, consisting of one input \(L_{1}\), one output \(O_{1}\) and one or more hidden layers \(H_{1},\ldots H_{n}\), with the ability to process information of a non-linear nature, to solve supervised or unsupervised learning problems [66]. As the name indicates, the neurons are densely connected, with each neuron receiving information from the previous layer, similar to an AE, providing an initial abstraction layer that is the basis for networks such as CNNs and RNNs. Their great ability to generalize a scenario has made them preferred over shallow algorithms [22; 38], which need more processing tasks before learning from the samples that encompass the context. Figure 6 depicts the architectural form of a DDNN.  
For stability purposes, a DDNN with rectified linear units (ReLU) activation functions with three hidden layers is proposed to establish a non-linearity criteria following a regularized dropout layer and a sigmoid output layer, since the expected values will be binary \(y\in[0,1]\), where \(0\) represents a benign site and \(1\) cryptojacking. The final architecture of the DDNN, used for this project, is described in Figure 7 and Table 5.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**General Configuration Properties** & **Layer** & **Units** & **Activation Function** \\ \hline Optimizer = ADAM & & & \\ Loss function: MSE (Equations (5) and (6)) & \(L_{1}\) & 18 & ReLU \\ Penalty value for \(\ell_{1}\) = \(10\times 10^{-5}\) & \(H_{1}\) & 14 & ReLU \\ Epochs = 100 & \(O_{1}\) & 9 & Softmax \\ Batch size = 32 & & & \\ Validation split = 20\% & & & \\ \hline \hline \end{tabular}
\end{table}
Table 4: Settings and parameters for SAE construction.  
Figure 6: Conceptual diagram of a feed-forward, fully connected DDNN. DDNNs have been applied in multiple cyber-security tasks [12; 26; 43; 44; 48; 49; 67] because of their ability to effectively analyze different backgrounds, types of values, and measurements in the collected data, often from sources that are presented in real time. The propagation of desired feature information between multiple neurons in the hidden layers \(H_{1}\) and \(H_{2}\) is strengthened, maximizing the recognition capability of a sample, in this case, cryptojacking.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**General Configuration Properties** & **Layer** & **Units** & **Activation Function** \\ \hline  & \(L_{1}\) & 9 & ReLU + weight constraint = 5 \\ Optimizer = ADAM & \(H_{1}\) & 120 & ReLU \\ Loss function: Binary Cross Entropy & \(H_{2}\) & 64 & ReLU \\ Epochs = 100 & \(H_{3}\) & 32 & ReLU \\ Batch size = 32 & Batch normalization layer & & \\ Validation split = 20\% & \(O_{1}\) & 1 & Sigmoid \\ \hline \hline \end{tabular}
\end{table}
Table 5: Settings and parameters for SAE construction.  
In Table 5, three hyper-parameters are introduced. The first concerns weight constraints, which are a way of adjusting weight sizes against a pre-established threshold, ideally functioning as regularization, ensuring that weights remain small during training, avoiding fading, or decay problems. The second with the training time, which through the normalization layer, helps to increase the learning coefficient, making it faster to learn and adjust weights, while ensuring that the input to the layer maintains a good distribution within the mean and standard deviation of the units. Thirdly, a loss function, called binary cross-entropy, is applied, which arises from taking advantage of the probabilistic relationship of the desired class distributions predicted by the DDNN. The LOSS function is denoted in Equation (7).  
\[LOSS=-\frac{1}{N}\sum_{i=1}^{N}y_{i}\cdot\mathbf{log}(\hat{y_{i}})+(1-y_{i}) \cdot\mathbf{log}(1-\hat{y_{i}}), \tag{7}\]  
where \(y_{i}\) is the expected class, \(\hat{y_{i}}\) the predicted output of the DDNN and \(N\) the size of the output.