# MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning
## 5 Evaluation
### Overhead and Detection Accuracy  
MinerBlock, No Coin, and AntiMiner mentioned in Section 3 are protected by blacklists. However, MinerBlock uses two protection mechanisms, which makes MinerBlock more accurate than No Coin and AntiMiner. Thus, in this subsection, we use MinerBlock to represent the blacklist mechanism. Moreover, we measured the resource usage overheads introduced by a browser installed with MinerBlock and a browser installed with MinerGuard. 1. Overhead for Handling Normal Web Pages: Figure 17 shows the CPU usage overheads of MinerGuard and MinerBlock when examining normal web pages. The solid lines in Figure 13 represent CPU usage overheads, where blue represents the CPU usage overheads of MinerGuard. The figure shows that the CPU usage overheads of MinerBlock approach zero most of the time. The overheads introduced by MinerBlock mainly occur when a browser completes downloading a web page because MinerBlock only checks a web page right after the page is downloaded by a browser. As a result, most of the time, the CPU usage overheads of MinerBlock are very low, and the overheads increase only when a browser downloads a web page. However, MinerGuard constantly executes in the background to collect the system resource usage of a browser; hence, MinerGuard's CPU usage overheads are higher than MinerBlock. Nonetheless, the overheads are maintained at 2%, which is trivial; thus, MinerGuard does not affect the normal operations of browsers installed. 2. Overhead for Handling Mining Web Pages: Figure 14 shows the CPU usage overheads of MinerGuard and MinerBlock for detecting mining web pages. The solid lines in Figure 18 represent CPU usage overheads, where dark blue represents the CPU usage overheads of MinerBlock and light blue represents the CPU usage overheads of MinerGuard. Figure 18 shows that the CPU usage overheads of MinerBlock are higher than that of MinerGuard. When handling a web page containing a script, MinerBlock needs to compare and check its blacklist. MinerBlock also needs to intercept web \begin{table}
\begin{tabular}{c c} \hline \hline
**Web Page Type** & **Number** \\ \hline Mining Web Page & 150 \\ \hline Mining Web Page with Users’ Approval & 200 \\ \hline Normal Web Page (Alexa Top 500) & 500 \\ \hline Total & 850 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Types of tested web pages. Figure 17: Resource usage overheads for handling normal web pages. requests. The above operations increase the CPU usage overheads of MinerBlock. Moreover, MinerBlock provides functions to edit its blacklist and whitelist. Both functions also increase the CPU usage overheads of MinerBlock. However, no matter what web pages MinerGuard handles, it just executes in the background to collect system resource usage. This operation only introduces about a 2% CPU usage overhead. However, classifying a web page using a neural network model and blocking the execution of a mining page add extra CPU usage overheads to MinerGuard. This is why the CPU usage overheads of MinerGuard suddenly increase a lot when it detects a mining page. Memory utilization in MinerGuard and MinerBlock is compared. The graph's dashed line represents memory use, and when it comes to finding mining locations, there is no discernible difference between MinerGuard's (yellow dashed line) and MinerBlock's (blue dashed line) memory usage. 3. Detection Accuracy: As shown in Figure 19, the accuracy of MinerGuard in detecting mining pages is 96%, while the accuracy of MinerBlock is 42.85%. Some web pages will inform their users of their using mining pages. These web pages execute mining scripts only after they obtain users' consent. Moreover, according to the definition of Cryptojacking, a web page is deemed malicious. Suppose the web page does not tell its users about its mining behavior. As a result, we do not classify the above type of web pages as mining pages.