# MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning
## 1 Introduction
It implies that Android phones and tablets would be impacted by malware and cryptojacking software. [PERSON] et al. [13] highlighted the value of using this method to find crypto-mining malware. They laid forth the precise procedures for developing and evaluating such systems and how to report the findings. BrenntDroid is a tool [PERSON] et al. [14] developed for detecting mining on Android smartphones. Its method builds a dataset by gathering prospective Android mining programs and studying their behavior to ascertain if they are actual miners. Using a scikit-learn package, they filtered the dataset, and items with low variance were disregarded. Pearson correlation coefficients were used to identify and remove the characteristics with solid correlation. Using ROC and AUC, they present the results of the random forest classifier. A machine learning approach for intelligent contract security analysis could be put out by [PERSON] et al. [15]. They gathered information from the Etherscan dataset, including the smart contracts' source code. After feature extraction, the dataset could process using four machine learning methods: SVM, NN, RF, and DT. Next, the source code had to be built. They computed accuracy, precision, recall, and F1 to report their findings. They concluded that no one strategy works best in all situations; instead, different problems need different solutions. Another approach to anomaly identification could be put out by [PERSON] et al. [16]. Identifying harmful nodes in blockchain networks is their primary objective. The duration between the node preparation and commit stages in various circumstances is an experimentally recorded statistic. They experimented with the KNN, CNN, SVM, Gaussian, and Bernoulli models, marking normal and abnormal data accordingly. [PERSON] et al. (2017) employed temporal graph features in blockchains with fewer rights to find rogue accounts. For their assessment, they used information from the Ether scanning API. It also utilized additional sources to find and label fraudulent charges in the dataset. They determined accuracy, recall, F1 score, and MCC scores to show the experimental outcomes. Additionally, they provide cosine similarity graphs to display the similarities between malicious and benign accounts and the association between old and new harmful versions. In September 2017, the web mining technology Eskandari ([PERSON], 2018) appeared and became popular. Later on, Coinhive mining scripts (Eskandari, 2018) were found on the web pages of the world's largest BitTorrent website, Pirate Bay. The scripts attempt to mine Bitcoin through Pirate Bay users' browsers. Many websites adopt this approach to mine cryptocurrencies without notifying their users of this behavior. Hence, the embedded scripts use users' CPU resources for mining without the users' consent. The mining operation slows down browser users' computer speed and increases the browser users' electricity bills. Abusing browser users' CPU resources in this way is called mining kidnapping ([PERSON], 2018). This situation may become worse because even when a user leaves a mining page and closes his browser, the CPU is still used for mining without the user's knowledge. A Cisco report ([PERSON], 2018) shows that \"in 2020, almost 70 percent of its customers were victims of crypto mining software\". As mining kidnapping began to spread in the wild to abuse browser users' CPU resources, many researchers started to propose methods to block web mining, such as recording the file names of mining scripts or the domain names of mining pages into a blacklist. Plug-ins such as MinerBlock, No Coin, and AntiMiner (2018), or techniques that use machine learning to analyze and detect virtual currency mining scripts, such as TLSH ([PERSON], 2018), were developed. However, mining kidnapping attacks continue to exist. Additionally, new mining scripts continue emerging in the wild. Obfuscation and encryption are used to change the forms of mining scripts. The domain names of mining scripts keep changing to avoid being detected.