Browser Crypto-Jacking Detection via Resource Profiling and Hash Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies lack effective methods to detect and remediate crypto-jacking malware, which hijacks computer resources for blockchain mining, leading to deviant browser behavior and resource consumption.
Innovation Solution
A computer-implemented method that monitors browser resource consumption, intercepts communications for cryptographic nonces and hash values, trains classifiers using different hashing algorithms, and identifies malicious miner code, triggering responsive actions such as terminating the miner code or blocking communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If blockchain miner code executes in the browser, then crypto-currency generation and network attack functions are performed, but browser resource consumption deviates from normal patterns and system performance degrades
Solution Approach 1:
A detection system acts as an intermediary between the browser and blockchain miner code, monitoring resource consumption patterns and intercepting communications. The system profiles normal browser behavior and compares actual resource usage against this profile to identify deviant patterns indicative of crypto-jacking, enabling detection without directly interfering with legitimate browser operations
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring browser resource consumption and comparing it against established profiles. When deviations are detected, the system triggers classification processes that analyze hash values and provide feedback about malicious activity, enabling dynamic response to crypto-jacking attempts
2Measurement precision
If resource monitoring and classification processes are implemented to detect crypto-jacking, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The detection system is segmented into distinct functional components: a profiling module that establishes normal browser behavior patterns, a monitoring module that tracks resource consumption, a classification module that analyzes hash values using multiple algorithms, and a response module that executes remediation actions. This segmentation allows each component to be optimized independently while maintaining overall system manageability
Solution Approach 2:
The system uses intermediary classification processes that bridge the gap between resource monitoring data and malicious code identification. Multiple classifiers trained on different hashing algorithms serve as intermediaries to interpret resource consumption patterns and hash values, providing a structured approach to detection that reduces system complexity while maintaining accuracy
Data Source
AI summary
A method of detecting blockchain miner code executing in a web browser including receiving a profile for the browser identifying typical resource consumption by the browser in use; responsive to a detection of a deviation of the resource consumption by the browser from the profile, intercepting a communication with the browser including a cryptographic nonce, training a plurality of classifiers based on generated training examples, each training example being generated by applying a hashing algorithm to the nonce such that each classifier is trained with training examples generated using a different hashing algorithm; intercepting one or more second communications with the browser, each of the second communications including a hash value; executing at least a subset of the classifiers based on the hash value of each of the second communications; and identifying malicious miner code executing in the browser.