Direct access to the system's resources such as the GPU, persistent storage and networking has enabled in-browser crypto-mining. Thus, there has been a massive response by rogue actors who abuse browsers for mining without the user's consent. This trend has grown steadily for the last months until this practice, i.e., CryptoJacking, has been acknowledged as the number one security threat by several antivirus companies. Considering this, and the fact that these attacks do not behave as JavaScript malware or other Web attacks, we propose and evaluate several approaches to detect in-browser mining. To this end, we collect information from the top 330.500 Alexa sites. Mainly, we used real-life browsers to visit sites while monitoring resourcerelated API calls and the browser's resource consumption, e.g., CPU. Our detection mechanisms are based on dynamic monitoring, so they are resistant to JavaScript obfuscation. Furthermore, our detection techniques can generalize well and classify previously unseen samples with up to 99.99% precision and recall for the benign class and up to 96% precision and recall for the mining class. These results demonstrate the applicability of detection mechanisms as a server-side approach, e.g., to support the enhancement of existing blacklists. Last but not least, we evaluated the feasibility of deploying prototypical implementations of some detection mechanisms directly on the browser. Specically, we measured the impact of in-browser API monitoring on page-loading time and performed micro-benchmarks for the execution of some classiers directly within the browser. In this regard, we ascertain that, even though there are engineering challenges to overcome, it is feasible and benecial for users to bring the mining detection to the browser. • Security and privacy → Browser security; Web protocol security; Web application security; Web Security, CryptoJacking, HTML5, Browser Abuse Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for prot or commercial advantage and that copies bear this notice and the full citation on the rst page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s).  HTML5 technologies such as WebGL and WebSockets contributed to achieve something that was attempted but not successful so far: in-browser crypto-currency mining [1] . On the one hand, cryptomining could be a business model where visitors use energy and computational resources in exchange for the content they get, instead of coping with advertisements and their privacy implications [14, 16, 29, 47] . However, system administrators, developers, and attackers have started embedding crypto-mining scripts through their own and third-party sites without the users' consent. Abusing the browser's resources for crypto-mining without the user's knowledge, i.e., CryptoJacking, has been already recognized by the ESET antivirus company as the top cyber attack today [17] . Further, Symantec states that browser-based CryptoJacking has increased by 8.500% in 2017 in their technical report [43] . From a practical perspective, there is no evidence of a transparent environment where users provide consent before sites start using their resources for mining. As a result, we propose to provision the browser with tools to detect on its own, without relying on information provided by the site visited, whether the site being rendered is performing mining or not. Our contributions can be summarized as follows: 1) we propose several novel mining detection techniques based on the system's resource consumption and resource-related browser API usage. 2) we evaluate and compare the performance of the dierent proposed techniques by collecting information about how sites use the browser most resource-related APIs and system's resources. For this, we used real-life browsers on 330.500 sites based on the Alexa top ranking. 3) we analyze the feasibility of porting APIbased mining detection to the browser. To this end, we perform a quantitative analysis of the overhead on the page loading time and execute micro-benchmarks for the detection algorithm. This paper is structured as follows: Section 2 states our problem. Sections 3 and 4 describe our methodology and evaluation. Then, we cover related work in Section 5 and draw conclusions from our work and discuss feature steps in Section 6. CryptoJacking has some critical dierences with malware and other Web attacks. First of all, JavaScript malware, as well as attacks against the users' sessions and data, are executed once. 313
Rodriguez and Posegga REF developed several approaches to detect in-browser mining monitoring dynamically API calls and resource consumption.
RAPID: Resource and API-Based Detection Against In-Browser Miners
ACSAC '18
Computer Science