# MinerGuard: A Solution to Detect Browser-Based Cryptocurrency Mining through Machine Learning
## 1 Introduction  
With the growth of the Internet, harmful code is now exhibiting a fast development trend. The Internet's diversity, speed, and scope are its primary expressions. Traditional malicious code detection techniques can no longer address the prerequisites for harmful code detection. Consider the detection of dangerous code using signatures. This technique gathers recognized harmful codes. When a new detection job is available, it consistently creates specific signatures and keeps a database of such signatures. Finding matches in the signature database allows for detection. The signature database requires a lot of work to update and maintain. Since machine learning algorithms may reveal deeper correlations between input characteristics, malicious code authors can bypass such detection methods by using simple changes like obfuscation, compression, and casing. The malicious code information would extensively abuse. As a result, machine learning-based harmful code detection often demonstrates improved accuracy and may, to a certain degree, automate the study of undiscovered hazardous code. Machine learning-based malicious code detectiontechniques have become a popular academic research area to address the problems mentioned earlier. Machine learning-based malicious code detection frequently demonstrates higher accuracy. To a certain extent, it can automate the analysis of unknown malicious code because machine learning algorithms can explore the deeper connections between input features and fully exploit the information of malicious codes. There are several different anti-cryptojacking malware detection and defense systems available today. Browser extensions that employ blacklists to stop malicious Bitcoin mining activities are among these detection and defense measures--for instance, Nocoin, minerBlock, and other tools for detection and protection. Using blacklists by these detection and protection tools is not a suitable solution. Criminal organizations that use malware for cryptojacking alter their domain names [1; 2]. It could be performed by antivirus software scanning for a set of predetermined keywords, for instance, coin, miner, and Coinhive, identifying the function name used by the web page's cryptojacked script to carry out signature matching. Additionally, it would have been claimed that this detection method is simple to bypass [3]. Researchers have suggested many high-precision detection solutions for crypto-jacking malware and existing protective measures. Examining dynamic characteristics is the foundation of most of these strategies. These include block-level analysis and dynamic detection [4; 5; 6], hardware performance counters [7], signature matching based on hardware performance counters, instruction count-based analysis, and memory events, CPU, memory, and network traffic features [8; 9; 10], runtime, network, mining-related, and browser-based features [11], and fixed thresholds. While promising and reporting excellent detection accuracy, the current detection method. There are also several difficulties to consider, such as the substantial runtime overhead of research using dynamic analytic methods. They also experience measurement errors brought on by external processes and applications' noise. Additionally, to monitor CPU and memory events, they need administrator access. Benign Web apps also use WebAssembly, WebWorkers, and WebSockets. Therefore, current dynamic technologies may have a high risk of false positives. Additionally, using proxies, encrypted communications, and dynamically produced domain names by password hijacking writers renders detection techniques that depend on network data analysis ineffective. Finally, the end-online user's browsing experience would impact by dynamic analysis and instrument-based detection systems that operate continually in the backend. There are several risks and descriptions of harmful programs that damage Android smartphones, according to [PERSON] et al. [12]. The term \"cryptojacking apps\" refers to one of the harmful programs on the list.