Cryptojacking uses a visitor’s computing resources to mine cryptocurrency without their consent. Hidden miners can evade common defenses through obfuscation, WebAssembly, changing domains and throttling their activity.
CoinPolice varies the CPU resources available to a browser and studies how the workload responds. A neural classifier uses that behavior to identify concealed mining, including aggressively throttled miners. The paper reports a 97.87% detection rate with a 0.74% false positive rate and applies the method in a large-scale investigation that identifies 6,700 mining sites.
