# Detecting Cryptojacking Web Threats: An Approach with Autoencoders and Deep Dense Neural Networks
## 5 Proposed Framework
### Data Collection
Secondly, the compendium presented in [42] was integrated, which likewise, employs a list of malicious sites that have been previously sandboxed and tagged with some sign of illegal cryptomining. This breaks down into a list of 913,554 benign sites, 63,002 URLs that could not be accessed correctly or displayed some HTTP error code, 415 suspicious sites with some type of embedded malware, and 887 sites that were undeniably classified as malicious. From a total of 2038 sites, a first fingerprinting traversal run was executed using Selenium, with the objective of extracting active cryptojacking script structures and therefore confirming if the site is still operating. For this, HTTP responses with uploaded.js object extensions were identified and captured. Afterwards, the asynchronous XMLHttpRequest loads were filtered out. Finally, a parsing process to HTML content, to select only DOM tags that matched a regular expression, was designed to highlight any element within the normative JavaScript syntax. Each discovered script was transformed at a character level using the TF-IDF (term frequency-inverse document frequency) algorithm, known to statistically encode words or letters based on their relevance and represented by weights (normalized values under the range of \([0,1]\)) comprised in a vector, of vocabulary length (number of encoded characters). To filter the sites, each vectorized script was compared by cosine distance against the summary presented in [42], where 981 cryptojacking code fragments are presented. If the site does not present an error code or a timeout and the similarity is greater than 0.8, the presence of scripts is confirmed, labeled as cryptojacking and stored in the database, along with the DNS resolutions, domain names, IP addresses, and access nodes, with  
Figure 3: Proposed strategy for the capture of cryptojacking samples. which it interacts to complete the PoW. According to [54], the similarity values vary in the range \([0,1]\), where 0 represents the absence of similarity and 1 the perfect comparison. The threshold is difficult to establish since 0.6 could be said to represent a 60% match. In this particular scenario the highest similarity was 0.91 and 0.13 the lowest, with an overall average of 0.82. Thus, 0.8 was left as the optimal criterion as a minimum similarity. For those that do not exceed the threshold, but could be suspicious, a second traversal recursive tracker was programmed to follow requests and links to the already identified lists from the first traversal run, if any of the following scenarios occur: unwanted downloads, pop-up flooding, or malvertising, URLs with encoded characters or pronounced length, constant redirects, and forced clicks. If a request matches, then the site is also labeled as cryptojacking and appended to the database. In a third traversal run, the previously confirmed and stored sites were used as the basis for customized queries on Public WWW [55] databases, which is a source code search engine that allows finding any alphanumeric fragment, signature or keyword over HTML, JS, and CSS documents across a wide selection of websites. To complete the dataset with benign sites, a random selection was made from those listed in Alexa Top Domain List [41], since a large part of them share similar anatomies: active HTTPs configuration from common certificate authority companies, controlled redispatching to non-out-of-domain links or subdomains, presence of CSRF tokens in POST methods or X-CSRF-TOKEN header attributes and cross-domain policies. On the other hand, other security policies that they share are: JS execution is limited to interactions within the DOM, asynchronous uploads are restricted to the same host or domains with same-protocol policies and through verified whitelisting of social networks, payment APIs, animation scripts, and web development frameworks. The final dataset comprises 8000 random benign sites, and 8156 tagged and validated as cryptojacking.