Cryptojacking Detection Using Genetic Search Algorithm

Abstract

Mining cryptocurrency with unauthorized and unlawful access to a victim’s computer’s processing power is called cryptojacking. With the rise of cryptocurrency in the markets, people took advantage of this new piece of technology through mining it and earning from it. When the need for more performance and money emerged, people came out with unlawful activities to mine cryptocurrency using others' devices without their consent. These activities have left people and their devices vulnerable for the sake of greed. This is a distributive approach which uses a victim’s machine to mine cryptocurrency using all its resources, i.e., CPU, GPU, etc. This doesn’t need any software installation but just to visit sites which are embedded with malicious scripts that help access the user’s device. The analogy of this study is not limited to detecting the presence of cryptojacking but also to enable users to detect the presence of any kind of suspicious activity performed on the device. Through the Genetic Search algorithm, we extracted some of the key metrics used by computers to monitor its resources and further used these metrics to classify the presence of any unauthorized activity and achieved 100% accuracy for classifying these instances. The classification was done using several classification algorithms such as SVM (kernel – “linear”), SVM (kernel – “Radial Bias Function”), Logistic Regression, Decision Tree Classifier, Random Forest Classifier, Multi-Layer Perceptron. The Genetic Search algorithm mentioned earlier is a machine learning iterative technique which is based on natural selection. It selects individuals from the current population as parents and uses them to generate the next generation of offspring, all through a method called CfsSubsetEval which returns a fitness score to the child based on their dependency on other attributes. For comparison, we also used several methods which also serve the same objective.