# A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware
## 2 Literature Review
### Hybrid Approaches  
[PERSON] et al. [33] proposed a detection technique for in-browser cryptojacking malware. They merged host and network-based features and selected 18 unique features from the dataset of 8000 benign websites and the Alexa dataset with 8156 malicious samples, respectively. The Alexa dataset extracted all the malicious samples from different mining service providers. Then, they applied Z-score normalization and autoencoders for dimension reduction and data compression in the preprocessing phase. The training data passed through a deep, dense neural network had an input layer, three hidden layers, and one output layer using the sigmoid activation function. The other layers used the leaky ReLU as the activation function. Their approach has a recall score of 99.25% and has a short training time. [PERSON] et al. [34] applied a deep neural network, Long Short-Term Memory (LSTM) [35], that used the performance counters of Windows as the data. They trained their model on 1200 samples with the HPU and CPU usage as the key features and achieved a precision value of 96% and a recall score of 97%. [PERSON] et al. [10] presented a taint analysis to prevent cryptojacking attacks. Their approach performed two detection checks. They first measured the CPU usage of a website. If the CPU usage was more than 99%, they started the second check. In this check, they compared the scripts run in the background of a website with already blacklisted websites that contain traces of malicious scripts from the AdBlock-no-coin-list. They added the malicious website to the log of malicious scripts. They sent a notification to the user after the second check. Although, this technique deploys double detection, using only 99% as a threshold which is not idle as the cryptojacking malware and getting more and more complex which is capable of throttling the CPU usage. However, only a notification is not sufficient to prevent malware. [PERSON] and [PERSON] [11] proposed two ways for the detection of cryptojacking malware. First, they checked whether the URL of the visited website is present in the blacklisted database. If not, then they analyzed the dynamic behavior and detected potential mining behavior. They ran the application as a web extension with a user-friendly interface. They detected inline cryptojacking and proxy networks. However, they required no special permissions to work, which might be a potential risk. Moreover, their approach lacks to auto-add the detected malicious website to the blacklisted domain. [PERSON] et al. proposed MineThrottle [12], a technique for detecting and preventing cryptojacking malware. Their approach operates in three modes: interpreting, detection, and defense. In the interpreting mode, it extracts mining-related code blocks. In the detection mode, it detects the mining code's speed and compares it with the average speed. In the defense mode, it suspends the detected malicious code for a defined time interval. MineThrottle uses block-level profiling to reduce the complexity and can work in real time, but it only detects and prevents web-assembly (WASM) scripts. Cryptojacking malware