# A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware
## 2 Literature Review
### Dynamic Approaches  
[PERSON] et al. [19] presented a dynamic web-based cryptojacking detection approach called Minos. They used WASM-based samples collected from the malware dataset of PublicWWW and focused on the image frames of the malicious samples using a Convolutional Neural Network (CNN). Their detection technique achieved an accuracy of 98.97% while using only 4% of the CPU, making this approach very convenient to run on any platform. [PERSON] et al. [20] presented a framework for detecting and analyzing in-browser cryptojacking malware, named MiningHunter. This framework can detect malware even if implementing an obfuscation technique on it. It was used on Alexa's top 1 million websites and gathered 13 million unique websites containing JavaScript embedded in them. They used a total size of 246 GB of websites. They found that 3178 websites had cryptojacking malware embedded in them. They classified these cryptojacking attacks based on matching and provided in-depth details of their effect on the internet. Similarly, [PERSON] et al. [21] developed machine learning techniques and analyzed the NetFlow and IPFIX features. They used the decision tree algorithm and were able to detect cryptocurrency miners. Their detection technique is cost-effective as it requires no payload to analyze a packet. Overall, this dynamic approach achieved a recall value of 90% while using the network traffic studied via the Stratum protocol as a dataset of six cryptocurrencies. [PERSON] et al. [22] presented an in-browser cryptojacking attack and examined its three phases. They also used Alexa's top 1 million websites as a dataset for their study. They concluded that 0.2% of websites are affected by cryptojacking malware. They also studied the insights of cryptojacking malware (e.g., specific code features and how much revenue they may generate) and their countermeasures. [PERSON] et al. [23] also presented a detection technique for an in-browser cryptojacking malware. They used a dataset of 1159 snapshots of memory of the running browsers that modified the browser kernel code of Chrome. They used a Recurrent Neural Network (RNN) model and analyzed the features of Heap snapshots and the code stack to detect in-browser cryptojacking attacks. They achieved a 95% precision rate and a 93% recall value. [PERSON] et al. [24] analyzed the network features and achieved the true positive rate (TPR) of 92%. Similarly, [PERSON] et al. [18] used CPU memory features from the Alexa 100k dataset by applying a neural network and achieved an accuracy of 97.9%. [PERSON] et al. [25] used the SVM approach and analyzed the features of hardware cache events. They achieved 97% precision in cryptojacking detection. Similarly, [PERSON] et al. [26] applied Random Forest by analyzing the features of HPC values and achieved a 100% precision rate for detecting cryptojacking attacks. [PERSON] et al. [27] detected the cryptojacking malware based on CPU cache events. They analyzed the Alexa 1 Million dataset for cryptojacking detection. [PERSON] et al. [28] detected cryptojacking malware and analyzed the JavaScript execution and its compilation time. They used the Alex 600,000 dataset for analysis purposes. Similarly, [PERSON] et al. [29] presented a work that detects cryptojacking malware based on hash features. They used the Alexa 100,000 dataset and achieved a 100% TPR. [PERSON] et al. [30] presented a technique that dynamically detects malware based on WASM instructions. They used the Alexa 500 dataset for analysis and achieved 98% F1 scores. The above study shows that most of the works from the literature focus only on the detection technique and propose no prevention techniques. [PERSON] [31] also presented a new Cap-Jack method using CapsNet technology and identified illicit Bitcoin cryptomining activity in a browser. His approach can detect malware and fraudulent miners efficiently and heuristically using system behavior or even in a situation where several apps are active simultaneously. [PERSON] et al.