# MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning
## 4 System Design
### System Structure  
Figure 8 shows the system structure of MinerGuard. The figure shows the major components, execution flows, and data flows of MinerGuard. MinerGuard consists of six major components, a System Information Collector, a Format Converter, an Artificial Neural Network Model, a Model Trainer, a Miner Blocking Controller, and a Database. Section 4.2 gives a detailed description of these components. These six central components are further divided into three parts, the client side, the server side, and the database.  
The client side consists of a System Information Collector and a Miner Blocking Controller. The client side is implemented as a Chrome extension. The server side consists of a Format Converter, an Artificial Neural Network Model, and a Model Trainer. The server side is implemented as a program that communicates with the client and the database. The server side and the database can be on the same host where the client-side resides. The server-side and the database can also be located on a different host and serve multiple client sides on distinct hosts. Under the above structure, the server-side can collect and analyze data from various client sides, increasing the mining page detection accuracy of MinerGuard. Moreover, multiple clients using the same server side can share their previous web page analysis results, thus increasing the performance of MinerGuard.  
When a user opens the browser, MinerGuard automatically executes in the background until the browser is closed. The data flows in MinerGuard can be divided into six flows, each of which is described as follows:  
1. MinerGuard observes the browser's system resource usage in the background. Whenever the amount of system data sufficient for identification by the artificial neural network model is collected, the system data are passed to the Format Converter for conversion.
2. The Format Converter extracts the CPU usage data from the original system resource data, converts it into CSV format, and stores it in the database.
3. Transfer the CPU data collected in the database as training data to the Model Trainer.
4. Set the Artificial Neural Network Model parameters according to the training data to train the best model. Generate an Artificial Neural Network Model responsible for identification.  
Figure 8: System structure.  
Figure 7: Execution flow of MinerGuard.  
5. The converted data are sent to the Artificial Neural Network Model, classified by the model, and the converted CPU data are classified as value 0 or 1; 0 means the web page has a malicious mining script.
6. The value of this classification is transmitted back to the Miner Block Controller on the client side. If it is classified as 0, the operation of the mining script of this web page is blocked. If the classification is standard, no action is taken.  
In short, MinerGuard starts working when a user uses a browser to visit a web page. The System Information Collector then continuously observes the CPU usage in the background and sends the collected CPU usage data to the Format Converter of the server-side. The Format Converter converts the original CPU data into the input format of the Artificial Neural Network Model, a pre-processing action. The data are stored in the database. Then, the converted data are sent to the artificial neural network model for prediction, and the predicted result is transmitted back to the user. Based on the development, the component Miner Block Controller decides whether the browser should stop the execution of script code on the web page or not.