Pith. sign in

REVIEW 4 major objections 5 minor 76 references

Dynamic Graph-based Fingerprinting of In-browser Cryptomining

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PoT (Proof-of-Theft), a detector that fingerprints WebAssembly programs by the flow of data into three bitwise instructions, reports 98.3 percent accuracy at spotting obfuscated in-browser cryptominers.

desk verdict A genuinely new graph-fingerprinting idea for cryptojacking detection, but the headline accuracy rests on a razor-thin margin over stochastic noise and needs a robustness pass before I'd trust the numbers. read the letter →

arxiv 2505.02493 v1 pith:WBDXL4PL submitted 2025-05-05 cs.CR cs.PL

Tanapoom Sermchaiwong , Jiasi Shen This is my paper · ORCID
classification cs.CRcs.PL
keywords softwaresecuritycryptocurrencymalwaredetectiondynamicanalysisdata-flowgraphWebAssemblycryptojackingobfuscation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that instruction-level data-flow graphs, traced from WebAssembly execution, can fingerprint cryptomining computation well enough to survive standard obfuscation. It proposes two techniques: a graph-simplification algorithm that merges repeated substructures at the same depth to shrink graphs by more than 97 percent, and the n-fragment inclusion score, which measures how often small connected pieces of a known miner's graph appear inside a sample. On a benchmark of six miners, thirty obfuscated variants, and twenty-nine benign WebAssembly applications, the combined framework PoT reports 98.3 percent accuracy at a 0.65 threshold, with 100 percent specificity, outperforming three prior detectors. This matters because existing detectors based on instruction counts, binary images, or file metadata are known to be evadable, while the repeated hashing computation at the heart of proof-of-work is harder to disguise.

What carries the argument

The input is a dynamic data-flow graph built from WebAssembly execution traces; PoT records only data flowing into the three instructions and, shr, and xor, on the prior finding that these dominate proof-of-work hashing. Two mechanisms carry the argument. First, approximate graph simplification: because mining loops repeat the same hashing computation, the graph contains many isomorphic maximal rooted subgraphs at the same depth; Theorem 5 shows that the probability a vertex is visited in a backward random walk is determined entirely by its maximal rooted subgraph, so merging vertices with similar visit probabilities approximates exact merging and shrinks typical graphs by 93–99 percent. Second, the n-fragment inclusion score (n-FIS): for a known miner fingerprint H and a sample graph G, the score is the probability that a uniformly random connected subgraph of H with exactly $n$ edges is also a subgraph of G. PoT uses $n = 5$ and $k = 500$ randomly sampled fragments, tested with an approximate subgraph matcher, and flags a sample as malicious if any miner fingerprint scores at least 0.65.

What would settle it

Rewrite one of the six miners so that its hash loop performs the same bit operations without ever using and, shr, or xor (for example, via arithmetic identities or lookup tables), run it through the full PoT pipeline, and check whether any n-FIS score stays above 0.65; if the score falls below the threshold, the fingerprint is evadable by construction and the claimed accuracy is specific to the tested opcode footprint.

Watch

Extended reading notes

Core claim

PoT's central claim is that the data-flow structure of a proof-of-work computation is a stable behavioral signature of cryptomining that survives standard obfuscation. The paper builds dynamic data-flow graphs from WebAssembly traces, recording for each execution of and, shr, and xor where its operands came from, so that repeated hashing iterations appear as repeated isomorphic subgraphs. To keep the graphs tractable, PoT merges isomorphic maximal rooted subgraphs at the same depth, using a backward-random-walk approximation validated by Theorem 5; typical graphs drop from over a thousand vertices to fewer than thirty. To decide whether a sample is malicious, PoT compares its simplified graph against a database of known miner fingerprints with the n-fragment inclusion score at $n = 5$, counting how often small connected fragments of the miner's fingerprint appear in the sample. On a benchmark of six open-source miners, thirty obfuscated variants, and twenty-nine real-world WebAssembly applications, PoT detects all six original miners and twenty-nine of thirty obfuscated variants while flagging no benign application, achieving the reported 98.3 percent accuracy and 100 percent specificity at the 0.65 threshold; the authors attribute this resilience to local fragment-based comparison rather than any global graph distance.

Load-bearing premise

The load-bearing premise is that all the signal comes from data flowing into only three instructions — and, shr, and xor — so any proof-of-work implementation or obfuscator that avoids or replaces these opcodes would be invisible to the fingerprint; the paper adopts this premise from an earlier study and does not re-test it on the obfuscated binaries.

Editorial extensions

If this is right

  • Obfuscations that defeat binary-image and instruction-count detectors — arithmetic encoding, control-flow flattening, bogus control flow, basic-block splitting, and instruction substitution — leave the data-flow fingerprint recognizable, so PoT catches 29 of 30 obfuscated miner samples at the 0.65 threshold.
  • Graph simplification makes the approach practical: data-flow graphs of over a thousand vertices shrink to a few dozen, cutting the time needed for fingerprint comparison.
  • Because the fingerprint records the structure of the computation rather than WebAssembly syntax, the same pipeline transfers to other execution platforms such as servers and data centers where cryptojacking also occurs.
  • The pairwise n-FIS scores separate distinct mining algorithms — CryptoNight variants share high mutual scores while Bitcoin, Ethereum, and yescrypt miners remain distinct — so the fingerprint carries algorithm identity, not just a miner/non-miner label.
  • New mining algorithms need only be fingerprinted once, and the paper notes that cryptomining scripts and algorithms are low in diversity, keeping the fingerprint database small.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not test whether an obfuscator could eliminate the three instrumented opcodes entirely; a natural extension is to generate miner variants that implement the same bit operations via arithmetic or table lookups and check whether the 0.65 threshold still fires. If such variants evade detection, the practical fix would be to broaden the instrumented instruction set.
  • Because the simplification merges away the frequency of repeated substructures, the method should be insensitive to miners that pad their hash loops with extra iterations; conversely, a miner whose obfuscation fragments its computation into many non-isomorphic shapes could defeat the fingerprint, and that direction is untested.
  • The paper recommends per-fingerprint thresholds because the xmr fingerprint's small, simple graph produces high inclusion scores in several benign applications; a deployment would need score normalization, for example dividing by graph size, before the 100 percent specificity claim carries over to larger and more diverse benign workloads.
  • The same data-flow fingerprint idea could be applied to native binaries through dynamic binary instrumentation to cover server-side cryptomining; the paper claims generic applicability but demonstrates it only in WebAssembly, so the transfer remains a conjecture.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript presents PoT, a dynamic-analysis framework that detects in-browser WebAssembly cryptominers by (i) building instruction-level data-flow graphs from executions of three Wasm opcodes (and, shr, xor), (ii) simplifying these graphs with a random-backward-walk approximate merge of isomorphic rooted subgraphs, and (iii) classifying a sample by its n-fragment inclusion score against a database of simplified miner fingerprints. The authors report 98.3% accuracy, 96.7% sensitivity, and 100% specificity at a 0.65 threshold on a 65-sample benchmark (6 open-source miners, 30 obfuscated variants, 29 benign web apps), outperforming MINOS, Minesweeper, and WASim. The paper also contributes theorems relating backward-walk visit probabilities to isomorphic rooted subgraphs and a synthetic-family analysis of the simplification approximation.

Significance. If the reported results were robust, PoT would be a meaningful step for obfuscation-resilient cryptojacking detection: it uses a genuinely different signal (dynamic data-flow structure rather than instruction counts or binary images), the simplification idea is plausible, and the n-FIS measure is well motivated for fragmented graphs. The comparison against three prior systems is also useful. The paper is honest about the low diversity of real-world miners and the signature-database limitation. The main strengths are the formalization of the simplification step (Theorems 5, 8, 9) and the concrete evaluation against baselines on a documented benchmark. However, the current evaluation is too in-sample and too small to support the headline performance numbers, and some reported numbers are internally inconsistent. The central idea is defensible, but the evidence needs substantial strengthening.

major comments (4)
  1. [§4.3 and §6.3, Table 7] The detection threshold (0.65) and the hyperparameters n=5 and k=500 are selected using the same 65-sample benchmark on which Table 7 reports performance; §4.3 states that n and k were 'chosen based on evaluation', and §6.3.1 introduces the 0.65 threshold as an 'empirical decision boundary'. Consequently, the 98.3% accuracy is a resubstitution estimate, not a prediction on unseen data. The authors should evaluate with a held-out set, cross-validation folds, or at minimum select the threshold on a training split and report performance on untouched samples. Without this, the headline comparison against the baselines is not a fair test of generalization.
  2. [Definition 10, Algorithm 2, Table 6] The n-FIS score is a stochastic estimate: Algorithm 2 draws only k=500 random connected subgraphs, and Algorithm 1 itself uses random backward walks. Table 6 shows that the two decisive classifications at the 0.65 threshold are very close to the boundary: benign 'factorial' scores 0.639 against 'wmp' (margin 0.011), and 'btc-emccobf-split' scores 0.653 against 'btc' (margin 0.003). For a binomial estimate with k=500 and p near 0.65, the standard error is about 0.021, so each of these decisions has a substantial probability of flipping under an independent reseeding. The paper reports no random seed, no confidence intervals, and no repeated-run variance, so the claimed 98.3% accuracy, 96.7% sensitivity, and 100% specificity are point estimates from a single stochastic draw. The authors should report means and variances over multiple runs, or replace the estimate with exact n-FIS values for the small simplified graphs.
  3. [Table 7 vs. Table 6] The confusion matrix implied by Table 6 at the 0.65 threshold does not match the metrics in Table 7. With one missed obfuscated sample out of 36 total miners and all 29 non-miners correctly rejected, the counts are TP=35, FN=1, TN=29, FP=0, giving accuracy 64/65 = 98.5%, sensitivity 35/36 = 97.2%, and F1 = 70/71 = 98.6%, not 98.3%, 96.7%, and 98.3%. The value 96.7% corresponds to 29/30 obfuscated samples, suggesting the sensitivity is computed only over the obfuscated subset while the accuracy is computed over all 65 samples. The authors should recompute all metrics from a single, explicitly stated confusion matrix and make the denominator clear.
  4. [§4.2.1, Theorems 8–9] The validation of the approximation quality is not quantitatively supported. Theorems 8 and 9 show only that the exact and approximate simplified graphs are contained in the universal graph G_N; they do not show that the approximate simplification is close to the exact simplification. The subsequent claim that 'about 90% of all H in H4 are also in A4' is based on an unspecified random sample of H4, with no sample size, sampling procedure, or confidence interval reported (and E4 and A4 are related to H4 in a way that does not directly yield the stated 90% figure). Because RQ1's argument that simplification 'preserves local substructures' relies on this approximation, the authors should provide a reproducible, statistically grounded analysis, ideally with exact enumeration for the small cases or a rigorous bound for the graphs that occur in the benchmark.
minor comments (5)
  1. [Abstract and §6.4] The abstract contains the typo 'then-fragment inclusion score' instead of 'n-fragment inclusion score', and §6.4 contains 'precense' instead of 'presence'.
  2. [§6.3.1 and Table 7] The text in §6.3.1 states a sensitivity of 96.6%, while Table 7 reports 96.7%; since 29/30 = 96.7%, the text should use a consistent figure or explain the discrepancy.
  3. [§4.2.1 and Table 3] The statement that 'the graphs in our experiment have up to 1000 nodes and 2000 edges' is contradicted by Table 3, where several samples (e.g., cn-emccobf-substitute, xmr-emccobf-substitute) have over 2000 vertices.
  4. [Introduction and §2.3] The claim that this is 'the first to utilize instruction-level data-flow graphs in either detecting cryptominers or software classification in general' is in tension with the cited Anderson et al. [2] work on instruction-level resource graphs and Markov chains, as well as with earlier graph-based malware detection surveyed in §2.3. The novelty claim should be narrowed to 'the first to use instruction-level data-flow graphs for cryptominer detection' or otherwise qualified.
  5. [§6.1] The evaluation section does not state a random seed for the stochastic algorithms and does not mention an artifact release. Providing a seed, repeated-run statistics, and an artifact link would substantially improve reproducibility and would directly address the stability concern raised in the major comments.

Circularity Check

1 steps flagged · score 5.0 of 10

Reported 98.3% accuracy is an in-sample threshold fit: 0.65 is the empirical boundary placed between scores within one binomial standard error of each other.

  1. fitted input called prediction [Section 5 (Implementation); Section 6.3.1; Section 6.3.3; Table 6]
    "Scores are classified as malicious or benign on the basis of a static threshold. We present the reported scores and the empirical decision boundary in the evaluation section. [...] At this threshold, only 1 obfuscated sample is missed, with a sensitivity of 96.6%. [...] PoT was able to achieve an overall accuracy of 98.3% at the 0.65 detection threshold."

    The 0.65 cutoff is not pre-specified; it is the 'empirical decision boundary' chosen after computing n-FIS on the full benchmark, and the reported accuracy/sensitivity/specificity are measured on the same benchmark at this cutoff. Table 6 shows the fitted boundary sits in a tight gap: highest benign is factorial 0.639 (0.011 below), lowest detected positive is btc-emccobf-split 0.653 (0.003 above). Since Algorithm 2 uses k=500 random subgraphs, scores near 0.65 have binomial SE ~0.021, so decisive classifications can flip on reseeding. n=5 and k=500 are also 'chosen based on evaluation.' Thus the headline 98.3% is a threshold/hyperparameter fit to the same labels plus one stochastic draw, not an independent prediction.

full rationale

The graph-fingerprint derivation itself is not circular: fingerprints are generated from externally collected cryptominer binaries, the simplification algorithm (Algorithm 1) is defined independently of labels, and the n-FIS measure (Definition 10, Algorithm 2) is a genuine subgraph-containment statistic rather than a restatement of the detection decision. There are no load-bearing self-citations; the only external anchor, Seismic [72], is cited for the choice of and/xor/shr instructions, which is not the paper's own result. The circular component is confined to the evaluation protocol: the 0.65 threshold and the n=5, k=500 hyperparameters are selected after inspecting the same benchmark, and the reported 98.3% accuracy, 100% specificity, and 96.7% sensitivity are measured on that benchmark at the fitted cutoff. Table 6 shows the cutoff lies in a razor-thin gap where k=500 binomial noise makes individual classifications statistically indistinguishable. This makes the headline empirical claim partly a fit, although the underlying representation and similarity measure retain independent content.

Assumptions & free parameters 5 free parameters · 7 assumptions · 0 invented entities

The central claim depends on a small number of fitted hyperparameters (threshold, fragment size, sample count, random walk count, mean-shift bandwidth) and on domain assumptions about the structure of mining computations, the limits of obfuscation, and the sufficiency of the three instrumented instructions. No new physical or algorithmic entities are postulated beyond the n-FIS score and the simplification procedure, both of which are defined within the paper.

free parameters (5)
  • detection threshold = 0.65
    The n-FIS threshold for classifying a sample as malicious is chosen empirically from the evaluation set; at this threshold PoT achieves 98.3% accuracy, 96.7% sensitivity, and 100% specificity on the same data (Table 6, Section 6.3).
  • fragment size n = 5
    Chosen based on evaluation as a compromise between locality and robustness (Section 4.3.1).
  • number of random subgraph samples k = 500
    Chosen as 'a good stopping point' based on evaluation (Section 4.3.1).
  • number of backward random walks = not reported
    The paper says 'a large number of times' (Section 4.2.1) but does not report the exact count, affecting reproducibility.
  • mean shift bandwidth = not reported
    Mean shift clustering is used to group vertex probabilities in Algorithm 1; the bandwidth parameter is not described (Section 4.2.1).
assumptions (7)
  • domain assumption Proof-of-work miners perform extensive repetitive computation, which manifests as repeated isomorphic substructures in data-flow graphs.
    Motivates the whole fingerprinting scheme (Section 4, first paragraph).
  • domain assumption Code obfuscation can only make limited transformations to data-flow properties of a program.
    Invoked to justify that data-flow fingerprints survive obfuscation (Section 1, citing [46]; Section 4).
  • domain assumption Tracing only and, shr, xor instructions captures the distinguishing computation of cryptominers.
    Based on prior work by Wang et al. [72]; the paper instruments only these three instructions (Section 4.1).
  • domain assumption The detector has full access to the browser and can collect instruction traces of all WebAssembly execution.
    Stated in the threat model (Section 3).
  • ad hoc to paper Random backward walk probabilities are a sufficient basis for merging isomorphic substructures (Theorem 5) and the approximation is close for the graphs in the evaluation.
    The approximation quality is justified only by empirical sampling over a synthetic family G4 (Theorems 8-9, Section 4.2.1), and the claim that 'almost all graphs in our experiment' satisfy the size bound is contradicted by Table 3.
  • standard math Standard graph theory: for a DAG without multi-edges, the probability recurrence in Lemma 4 holds.
    Used to derive the random walk probabilities.
  • domain assumption The approximate subgraph matching tool ArcMatch provides correct inclusion answers for the tested fragments.
    The n-FIS score relies on ArcMatch for subgraph isomorphism checks (Section 4.3.1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Dynamic Graph-based Fingerprinting of In-browser Cryptomining." pith.science (2026). https://pith.science/paper/WBDXL4PL

@misc{pith2026250502493,
  author       = {Pith},
  title        = {Pith review of: Dynamic Graph-based Fingerprinting of In-browser Cryptomining},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WBDXL4PL}},
  note         = {Machine review of arXiv:2505.02493}
}
read the original abstract

The decentralized and unregulated nature of cryptocurrencies, combined with their monetary value, has made them a vehicle for various illicit activities. One such activity is cryptojacking, an attack that uses stolen computing resources to mine cryptocurrencies without consent for profit. In-browser cryptojacking malware exploits high-performance web technologies like WebAssembly to mine cryptocurrencies directly within the browser without file downloads. Although existing methods for cryptomining detection report high accuracy and low overhead, they are often susceptible to various forms of obfuscation, and due to the limited variety of cryptomining scripts in the wild, standard code obfuscation methods present a natural and appealing solution to avoid detection. To address these limitations, we propose using instruction-level data-flow graphs to detect cryptomining behavior. Data-flow graphs offer detailed structural insights into a program's computations, making them suitable for characterizing proof-of-work algorithms, but they can be difficult to analyze due to their large size and susceptibility to noise and fragmentation under obfuscation. We present two techniques to simplify and compare data-flow graphs: (1) a graph simplification algorithm to reduce the computational burden of processing large and granular data-flow graphs while preserving local substructures; and (2) a subgraph similarity measure, the n-fragment inclusion score, based on fragment inclusion that is robust against noise and obfuscation. Using data-flow graphs as computation fingerprints, our detection framework PoT (Proof-of-Theft) was able to achieve high detection accuracy against standard obfuscations, outperforming existing detection methods. Moreover, PoT uses generic data-flow properties that can be applied to other platforms more susceptible to cryptojacking such as servers and data centers.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

76 extracted references · 52 canonical work pages

  1. [1]

    Analyzing and detecting emerging internet of things malware: A graph-based approach

    Hisham Alasmary, Aminollah Khormali, Afsah Anwar, Jeman Park, Jinchun Choi, Ahmed Abusnaina, Amro Awad, Daehun Nyang, and Aziz Mohaisen. Analyzing and detecting emerging internet of things malware: A graph-based approach. IEEE Internet of Things Journal , 6(5):8977--8988, 2019. https://doi.org/10.1109/JIOT.2019.2925929 doi:10.1109/JIOT.2019.2925929

    arXiv 2019

  2. [2]

    Graph-based malware detection using dynamic analysis

    Blake Anderson, Daniel Quist, Joshua Neil, Curtis Storlie, and Terran Lane. Graph-based malware detection using dynamic analysis. Journal in Computer Virology , 7(4):247--258, 2011. https://doi.org/10.1007/s11416-011-0152-x doi:10.1007/s11416-011-0152-x

    work page doi:10.1007/s11416-011-0152-x 2011

  3. [3]

    O'Reilly Media, Inc

    Andreas M Antonopoulos. Mastering Bitcoin: unlocking digital cryptocurrencies . " O'Reilly Media, Inc.", 2014

    work page 2014

  4. [4]

    Arunkumar and K

    M. Arunkumar and K. Ashokkumar. A review on cloud computing security challenges, attacks and its countermeasures. AIP Conference Proceedings , 3037(1):020047, 04 2024. https://arxiv.org/abs/https://pubs.aip.org/aip/acp/article-pdf/doi/10.1063/5.0196063/19864474/020047\_1\_5.0196063.pdf arXiv:https://pubs.aip.org/aip/acp/article-pdf/doi/10.1063/5.0196063/1...

    work page doi:10.1063/5.0196063/19864474/020047 2024

  5. [5]

    Titzer, Sukyoung Ryu, and Michael Pradel

    Doehyun Baek, Jakob Getz, Yusung Sim, Daniel Lehmann, Ben L. Titzer, Sukyoung Ryu, and Michael Pradel. Wasm-r3: Record-reduce-replay for realistic and standalone webassembly benchmarks. Proc. ACM Program. Lang. , 8( OOPSLA2 ):2156--2182, 2024. https://doi.org/10.1145/3689787 doi:10.1145/3689787

    work page doi:10.1145/3689787 2024

  6. [6]

    Bajra, Ermir Rogova , and Sefer Avdiaj

    Ujkan Q. Bajra, Ermir Rogova , and Sefer Avdiaj. Cryptocurrency blockchain and its carbon footprint: Anticipating future challenges. Technology in Society , 77:102571, 2024. URL: https://www.sciencedirect.com/science/article/pii/S0160791X24001192, https://doi.org/10.1016/j.techsoc.2024.102571 doi:10.1016/j.techsoc.2024.102571

    work page arXiv 2024

  7. [7]

    Selcuk Uluagac

    Shrenik Bhansali, Ahmet Aris, Abbas Acar, Harun Oz, and A. Selcuk Uluagac. A first look at code obfuscation for webassembly. In Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks , WiSec '22, page 140–145, New York, NY, USA, 2022. Association for Computing Machinery. https://doi.org/10.1145/3507657.3528560 doi:1...

    arXiv 2022

  8. [8]

    Minethrottle: Defending against wasm in-browser cryptojacking

    Weikang Bian, Wei Meng, and Mingxue Zhang. Minethrottle: Defending against wasm in-browser cryptojacking. In Proceedings of The Web Conference 2020 , pages 3112--3118, 2020

    work page 2020

Show all 76 references
  1. [9]

    On the variable ordering in subgraph isomorphism algorithms

    Vincenzo Bonnici and Rosalba Giugno. On the variable ordering in subgraph isomorphism algorithms. IEEE ACM Trans. Comput. Biol. Bioinform. , 14(1):193--203, 2017. https://doi.org/10.1109/TCBB.2016.2515595 doi:10.1109/TCBB.2016.2515595

    2017

  2. [10]

    Shasha, and Alfredo Ferro

    Vincenzo Bonnici, Rosalba Giugno, Alfredo Pulvirenti, Dennis E. Shasha, and Alfredo Ferro. A subgraph isomorphism algorithm and its application to biochemical data. BMC Bioinform. , 14( S-7 ):S13, 2013. https://doi.org/10.1186/1471-2105-14-S7-S13 doi:10.1186/1471-2105-14-S7-S13

    2013 doi

  3. [11]

    Arcmatch: high-performance subgraph matching for labeled graphs by exploiting edge domains

    Vincenzo Bonnici, Roberto Grasso, Giovanni Micale, Antonio Di Maria, Dennis Shasha, Alfredo Pulvirenti, and Rosalba Giugno. Arcmatch: high-performance subgraph matching for labeled graphs by exploiting edge domains. Data Min. Knowl. Discov. , 38(6):3868--3921, 2024. URL: https...

    2024 doi

  4. [12]

    Webassembly diversification for malware evasion

    Javier Cabrera-Arteaga, Martin Monperrus, Tim Toady, and Benoit Baudry. Webassembly diversification for malware evasion. Computers & Security , 131:103296, 2023. URL: https://www.sciencedirect.com/science/article/pii/S0167404823002067, https://doi.org/10.1016/j.cose.2023.10329...

    2023

  5. [13]

    Cryptomining makes noise: Detecting cryptojacking via machine learning

    Maurantonio Caprolu, Simone Raponi, Gabriele Oligeri, and Roberto Di Pietro . Cryptomining makes noise: Detecting cryptojacking via machine learning. Computer Communications , 171:126--139, 2021. URL: https://www.sciencedirect.com/science/article/pii/S0140366421000797, https:/...

    2021 doi

  6. [14]

    You could be mine (d): the rise of cryptojacking

    Domhnall Carlin, Jonah Burgess, Philip O'Kane, and Sakir Sezer. You could be mine (d): the rise of cryptojacking. IEEE Security & Privacy , 18(2):16--22, 2019

    2019

  7. [15]

    Detecting cryptomining using dynamic analysis

    Domhnall Carlin, Philip O’Kane, Sakir Sezer, and Jonah Burgess. Detecting cryptomining using dynamic analysis. In 2018 16th Annual Conference on Privacy, Security and Trust (PST) , pages 1--6, 2018. https://doi.org/10.1109/PST.2018.8514167 doi:10.1109/PST.2018.8514167

    2018

  8. [16]

    [Accessed 10-02-2025]

    D ata: T he adoption rate of cryptocurrency is 43\ https://www.chaincatcher.com/en/article/2166659. [Accessed 10-02-2025]

    2025

  9. [17]

    A data protection approach for cloud-native applications

    Ramaswamy Chandramouli and Wesley Hales. A data protection approach for cloud-native applications. Technical report, National Institute of Standards and Technology, 2024

    2024

  10. [18]

    Asic-resistance of multi-hash proof-of-work mechanisms for blockchain consensus protocols

    Hyungmin Cho. Asic-resistance of multi-hash proof-of-work mechanisms for blockchain consensus protocols. IEEE Access , 6:66210--66222, 2018. https://doi.org/10.1109/ACCESS.2018.2878895 doi:10.1109/ACCESS.2018.2878895

    2018

  11. [19]

    [Accessed 10-02-2025]

    C oin I M P 0 https://www.coinimp.com/. [Accessed 10-02-2025]

    2025

  12. [20]

    H ome --- tigress.wtf

    Christian Collberg. H ome --- tigress.wtf. https://tigress.wtf/index.html. [Accessed 11-02-2025]

    2025

  13. [21]

    C rypto N ight - M onero D ocs --- docs.getmonero.org

    Monero Community. C rypto N ight - M onero D ocs --- docs.getmonero.org. https://docs.getmonero.org/proof-of-work/cryptonight/. [Accessed 14-02-2025]

    2025

  14. [22]

    Stephen A. Cook. The complexity of theorem-proving procedures. In Bruce M. Kapron, editor, Logic, Automata, and Computational Complexity: The Works of Stephen A. Cook , volume 43 of ACM Books , pages 143--152. ACM , 2023. https://doi.org/10.1145/3588287.3588297 doi:10.1145/358...

    2023

  15. [23]

    A first look at browser-based cryptojacking

    Shayan Eskandari, Andreas Leoutsarakos, Troy Mursch, and Jeremy Clark. A first look at browser-based cryptojacking. In 2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) , pages 58--66. IEEE, 2018

    2018

  16. [24]

    An analysis of the cryptocurrency industry

    Ryan Farell. An analysis of the cryptocurrency industry. Wharton Research Scholars , 130:1--23, 2015

    2015

  17. [25]

    C N C F A nnual S urvey 2023 --- cncf.io

    Cloud Native Computing Foundation. C N C F A nnual S urvey 2023 --- cncf.io. https://www.cncf.io/reports/cncf-annual-survey-2023/?utm_source=the+new+stack&utm_medium=referral&utm_content=inline-mention&utm_campaign=tns+platform. [Accessed 11-02-2025]

    2023

  18. [26]

    Cryptomining cannot change its spots: Detecting covert cryptomining using magnetic side-channel

    Ankit Gangwal and Mauro Conti. Cryptomining cannot change its spots: Detecting covert cryptomining using magnetic side-channel. IEEE Transactions on Information Forensics and Security , 15:1630--1639, 2020. https://doi.org/10.1109/TIFS.2019.2945171 doi:10.1109/TIFS.2019.2945171

    2020

  19. [27]

    Gdroid: Android malware detection and classification with graph convolutional network

    Han Gao, Shaoyin Cheng, and Weiming Zhang. Gdroid: Android malware detection and classification with graph convolutional network. Computers & Security , 106:102264, 2021. URL: https://www.sciencedirect.com/science/article/pii/S0167404821000882, https://doi.org/10.1016/j.cose.2...

    2021

  20. [28]

    Cryptojacking detection with cpu usage metrics

    Fábio Gomes and Miguel Correia. Cryptojacking detection with cpu usage metrics. In 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA) , pages 1--10, 2020. https://doi.org/10.1109/NCA51143.2020.9306696 doi:10.1109/NCA51143.2020.9306696

    2020

  21. [29]

    Schuff, Ben L

    Andreas Haas, Andreas Rossberg, Derek L. Schuff, Ben L. Titzer, Michael Holman, Dan Gohman, Luke Wagner, Alon Zakai, and JF Bastien. Bringing the web up to speed with webassembly. SIGPLAN Not. , 52(6):185–200, June 2017. https://doi.org/10.1145/3140587.3062363 doi:10.1145/3140...

    2017

  22. [30]

    Cryptic bytes: Webassembly obfuscation for evading cryptojacking detection

    H kon Harnes and Donn Morrison. Cryptic bytes: Webassembly obfuscation for evading cryptojacking detection. arXiv preprint arXiv:2403.15197 , 2024

    2024 arXiv

  23. [31]

    https://github.com/HikariObfuscator/Hikari

    G it H ub - H ikari O bfuscator/ H ikari: L L V M O bfuscator --- github.com. https://github.com/HikariObfuscator/Hikari. [Accessed 12-02-2025]

    2025

  24. [32]

    G it H ub - gorhill/u B lock: u B lock O rigin - A n efficient blocker for C hromium and F irefox

    Raymond Hill. G it H ub - gorhill/u B lock: u B lock O rigin - A n efficient blocker for C hromium and F irefox. F ast and lean. --- github.com. https://github.com/gorhill/uBlock. [Accessed 10-02-2025]

    2025

  25. [33]

    G it H ub - hoshsadiq/adblock-nocoin-list: B lock lists to prevent J ava S cript miners --- github.com

    hoshsadiq. G it H ub - hoshsadiq/adblock-nocoin-list: B lock lists to prevent J ava S cript miners --- github.com. https://github.com/hoshsadiq/adblock-nocoin-list. [Accessed 10-02-2025]

    2025

  26. [34]

    Xin Hu, Tzi-cker Chiueh, and Kang G. Shin. Large-scale malware indexing using function-call graphs. In Proceedings of the 16th ACM Conference on Computer and Communications Security , CCS '09, page 611–620, New York, NY, USA, 2009. Association for Computing Machinery. https://...

    2009

  27. [35]

    Obfuscator- LLVM -- software protection for the masses

    Pascal Junod, Julien Rinaldini, Johan Wehrli, and Julie Michielin. Obfuscator- LLVM -- software protection for the masses. In Brecht Wyseur, editor, Proceedings of the IEEE/ACM 1st International Workshop on Software Protection, SPRO'15 , Firenze, Italy, May 19th, 2015 , pages ...

    2015 doi

  28. [36]

    Browser-based deep behavioral detection of web cryptomining with coinspy

    Conor Kelton, Aruna Balasubramanian, Ramya Raghavendra, and Mudhakar Srivatsa. Browser-based deep behavioral detection of web cryptomining with coinspy. In Workshop on measurements, attacks, and defenses for the web (MADWeb) , pages 1--12. NDSS, 2020

    2020

  29. [37]

    G it H ub - keraf/ N o C oin: N o C oin is a tiny browser extension aiming to block coin miners such as C oinhive

    keraf. G it H ub - keraf/ N o C oin: N o C oin is a tiny browser extension aiming to block coin miners such as C oinhive. --- github.com. https://github.com/keraf/NoCoin. [Accessed 10-02-2025]

    2025

  30. [38]

    Outguard: Detecting in-browser covert cryptocurrency mining in the wild

    Amin Kharraz, Zane Ma, Paul Murley, Charles Lever, Joshua Mason, Andrew Miller, Nikita Borisov, Manos Antonakakis, and Michael Bailey. Outguard: Detecting in-browser covert cryptocurrency mining in the wild. In The World Wide Web Conference , WWW '19, page 840–852, New York, N...

    2019

  31. [39]

    Avengers, assemble! survey of webassembly security solutions

    Minseo Kim, Hyerean Jang, and Youngjoo Shin. Avengers, assemble! survey of webassembly security solutions. In 2022 IEEE 15th International Conference on Cloud Computing (CLOUD) , pages 543--553, 2022. https://doi.org/10.1109/CLOUD55607.2022.00077 doi:10.1109/CLOUD55607.2022.00077

    2022

  32. [40]

    Malware classification based on call graph clustering

    Joris Kinable and Orestis Kostakis. Malware classification based on call graph clustering. Journal in Computer Virology , 7(4):233--245, 2011. https://doi.org/10.1007/s11416-011-0151-y doi:10.1007/s11416-011-0151-y

    2011 doi

  33. [41]

    ' C ryptojacking' in F inancial S ector H as R isen 269 https://www.coindesk.com/business/2022/07/26/cryptojacking-in-financial-sector-has-risen-269-this-year-sonicwall-says

    Oliver Knight. ' C ryptojacking' in F inancial S ector H as R isen 269 https://www.coindesk.com/business/2022/07/26/cryptojacking-in-financial-sector-has-risen-269-this-year-sonicwall-says. [Accessed 10-02-2025]

    2022

  34. [42]

    Minesweeper: An in-depth look into drive-by cryptocurrency mining and its defense

    Radhesh Krishnan Konoth, Emanuele Vineti, Veelasha Moonsamy, Martina Lindorfer, Christopher Kruegel, Herbert Bos, and Giovanni Vigna. Minesweeper: An in-depth look into drive-by cryptocurrency mining and its defense. In Proceedings of the 2018 ACM SIGSAC Conference on Computer...

    2018

  35. [43]

    Wasabi: A framework for dynamically analyzing webassembly

    Daniel Lehmann and Michael Pradel. Wasabi: A framework for dynamically analyzing webassembly. In Iris Bahar, Maurice Herlihy, Emmett Witchel, and Alvin R. Lebeck, editors, Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Langua...

    2019

  36. [44]

    An anti-reverse engineering technique using native code and obfuscator-llvm for android applications

    Kyeonghwan Lim, Jaemin Jeong, Seong-je Cho, Jongmoo Choi, Minkyu Park, Sangchul Han, and Seongtae Jhang. An anti-reverse engineering technique using native code and obfuscator-llvm for android applications. In Proceedings of the International Conference on Research in Adaptive...

    2017

  37. [45]

    MBA-Blast : Unveiling and simplifying mixed Boolean-Arithmetic obfuscation

    Binbin Liu, Junfu Shen, Jiang Ming, Qilong Zheng, Jing Li, and Dongpeng Xu. MBA-Blast : Unveiling and simplifying mixed Boolean-Arithmetic obfuscation. In 30th USENIX Security Symposium (USENIX Security 21) , pages 1701--1718. USENIX Association, August 2021. URL: https://www....

    2021

  38. [46]

    Decrypto pro: Deep learning based cryptomining malware detection using performance counters

    Ganapathy Mani, Vikram Pasumarti, Bharat Bhargava, Faisal Tariq Vora, James MacDonald, Justin King, and Jason Kobes. Decrypto pro: Deep learning based cryptomining malware detection using performance counters. In 2020 IEEE International Conference on Autonomic Computing and Se...

    2020

  39. [47]

    mint M e | create your own token, monetize yourself! --- mintme.com

    mintme. mint M e | create your own token, monetize yourself! --- mintme.com. https://www.mintme.com/. [Accessed 14-02-2025]

    2025

  40. [48]

    https://www.getmonero.org/

    T he M onero P roject --- getmonero.org. https://www.getmonero.org/. [Accessed 14-02-2025]

    2025

  41. [49]

    U sing W eb W orkers - W eb A P I s | M D N --- developer.mozilla.org

    Mozilla. U sing W eb W orkers - W eb A P I s | M D N --- developer.mozilla.org. https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Using_web_workers. [Accessed 14-02-2025]

    2025

  42. [50]

    A brief survey of cryptocurrency systems

    Ujan Mukhopadhyay, Anthony Skjellum, Oluwakemi Hambolu, Jon Oakley, Lu Yu, and Richard Brooks. A brief survey of cryptocurrency systems. In 2016 14th Annual Conference on Privacy, Security and Trust (PST) , pages 745--752, 2016. https://doi.org/10.1109/PST.2016.7906988 doi:10....

    2016

  43. [51]

    New kid on the web: A study on the prevalence of webassembly in the wild

    Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck. New kid on the web: A study on the prevalence of webassembly in the wild. In Roberto Perdisci, Cl \'e mentine Maurice, Giorgio Giacinto, and Magnus Almgren, editors, Detection of Intrusions and Malware, and V...

    2019

  44. [52]

    Thieves in the browser: Web-based cryptojacking in the wild

    Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck. Thieves in the browser: Web-based cryptojacking in the wild. In Proceedings of the 14th International Conference on Availability, Reliability and Security , pages 1--10, 2019

    2019

  45. [53]

    Bitcoin whitepaper

    Satoshi Nakamoto. Bitcoin whitepaper. URL: https://bitcoin. org/bitcoin. pdf-(: 17.07. 2019) , 9:15, 2008

    2019

  46. [54]

    Minos: A lightweight real-time cryptojacking detection system

    Faraz Naseem Naseem, Ahmet Aris, Leonardo Babun, Ege Tekiner, and A Selcuk Uluagac. Minos: A lightweight real-time cryptojacking detection system. In NDSS , 2021

    2021

  47. [55]

    Cunha Neto, Martin Andreoni Lopez, Natalia C

    Helio N. Cunha Neto, Martin Andreoni Lopez, Natalia C. Fernandes, and Diogo M. F. Mattos. Minecap: super incremental learning for detecting and blocking cryptocurrency mining on software-defined networking. Annals of Telecommunications , 75(3):121--131, 2020. https://doi.org/1...

    2020 doi

  48. [56]

    https://www.openwall.com/yescrypt/

    yescrypt - scalable K D F and password hashing scheme --- openwall.com. https://www.openwall.com/yescrypt/. [Accessed 14-02-2025]

    2025

  49. [57]

    Fast malware classification by automated behavioral graph matching

    Younghee Park, Douglas Reeves, Vikram Mulukutla, and Balaji Sundaravel. Fast malware classification by automated behavioral graph matching. In Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research , CSIIRW '10, New York, NY, USA, 2010...

    2010

  50. [58]

    López, Leonardo Regano, Sandra Gómez-Canaval, and Antonio Lioy

    Antonio Pastor, Alberto Mozo, Stanislav Vakaruk, Daniele Canavese, Diego R. López, Leonardo Regano, Sandra Gómez-Canaval, and Antonio Lioy. Detection of encrypted cryptomining malware connections with machine and deep learning. IEEE Access , 8:158036--158055, 2020. https://doi...

    2020

  51. [59]

    E ven the U S government can fall victim to cryptojacking --- fedscoop.com

    Tim Starks Rebecca Heilweil. E ven the U S government can fall victim to cryptojacking --- fedscoop.com. https://fedscoop.com/cryptojacking-federal-government-agencies-usaid/. [Accessed 10-02-2025]

    2025

  52. [60]

    Rapid: Resource and api-based detection against in-browser miners

    Juan D Parra Rodriguez and Joachim Posegga. Rapid: Resource and api-based detection against in-browser miners. In Proceedings of the 34th Annual Computer Security Applications Conference , pages 313--326, 2018

    2018

  53. [61]

    Wasim: Understanding webassembly applications through classification

    Alan Romano and Weihang Wang. Wasim: Understanding webassembly applications through classification. In Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering , pages 1321--1325, 2020

    2020

  54. [62]

    Detection of illicit cryptomining using network metadata

    Michele Russo, Nedim S rndi \'c , and Pavel Laskov. Detection of illicit cryptomining using network metadata. EURASIP Journal on Information Security , 2021(1):11, 2021. https://doi.org/10.1186/s13635-021-00126-1 doi:10.1186/s13635-021-00126-1

    2021 doi

  55. [63]

    https://scikit-learn.org/stable/modules/generated/sklearn.cluster.MeanShift.html

    M ean S hift --- scikit-learn.org. https://scikit-learn.org/stable/modules/generated/sklearn.cluster.MeanShift.html. [Accessed 12-02-2025]

    2025

  56. [64]

    Connected substructure similarity search

    Haichuan Shang, Xuemin Lin, Ying Zhang, Jeffrey Xu Yu, and Wei Wang. Connected substructure similarity search. In Ahmed K. Elmagarmid and Divyakant Agrawal, editors, Proceedings of the ACM SIGMOD International Conference on Management of Data, SIGMOD 2010, Indianapolis, Indian...

    2010

  57. [65]

    Suresh and Sriram Sankaran

    Anjali J. Suresh and Sriram Sankaran. A framework for evaluation of software obfuscation tools for embedded devices. In Lejla Batina and Gang Li, editors, Applications and Techniques in Information Security , pages 1--13, Singapore, 2020. Springer Singapore

    2020

  58. [66]

    A lightweight iot cryptojacking detection mechanism in heterogeneous smart home networks

    Ege Tekiner, Abbas Acar, and A Selcuk Uluagac. A lightweight iot cryptojacking detection mechanism in heterogeneous smart home networks. In NDSS , 2022

    2022

  59. [67]

    In-browser cryptomining for good: An untold story

    Ege Tekiner, Abbas Acar, A Selcuk Uluagac, Engin Kirda, and Ali Aydin Selcuk. In-browser cryptomining for good: An untold story. In 2021 IEEE International Conference on Decentralized Applications and Infrastructures (DAPPS) , pages 20--29. IEEE, 2021

    2021

  60. [68]

    McEachin, Carlos Santos, David J

    Yuanyuan Tian, Richard C. McEachin, Carlos Santos, David J. States, and Jignesh M. Patel. SAGA: a subgraph matching tool for biological graphs. Bioinform. , 23(2):232--239, 2007. URL: https://doi.org/10.1093/bioinformatics/btl571, https://doi.org/10.1093/BIOINFORMATICS/BTL571 ...

    2007 doi

  61. [69]

    M ade with W eb A ssembly --- madewithwebassembly.com

    Aaron Turner, James Milner, and Jonathan Beri. M ade with W eb A ssembly --- madewithwebassembly.com. https://madewithwebassembly.com/. [Accessed 12-02-2025]

    2025

  62. [70]

    Is cryptojacking dead after coinhive shutdown? In 2020 3rd International Conference on Information and Computer Technologies (ICICT) , pages 385--389, 2020

    Said Varlioglu, Bilal Gonen, Murat Ozer, and Mehmet Bastug. Is cryptojacking dead after coinhive shutdown? In 2020 3rd International Conference on Information and Computer Technologies (ICICT) , pages 385--389, 2020. https://doi.org/10.1109/ICICT50521.2020.00068 doi:10.1109/IC...

    2020

  63. [71]

    Seismic: Secure in-lined script monitors for interrupting cryptojacks

    Wenhao Wang, Benjamin Ferrell, Xiaoyang Xu, Kevin W Hamlen, and Shuang Hao. Seismic: Secure in-lined script monitors for interrupting cryptojacks. In Computer Security: 23rd European Symposium on Research in Computer Security, ESORICS 2018, Barcelona, Spain, September 3-7, 201...

    2018

  64. [72]

    https://webassembly.org/

    W eb A ssembly --- webassembly.org. https://webassembly.org/. [Accessed 14-02-2025]

    2025

  65. [73]

    Williams, Jun Huan, and Wei Wang

    David W. Williams, Jun Huan, and Wei Wang. Graph database indexing using structured graph decomposition. In Rada Chirkova, Asuman Dogac, M. Tamer \" O zsu, and Timos K. Sellis, editors, Proceedings of the 23rd International Conference on Data Engineering, ICDE 2007, The Marmar...

    2007

  66. [74]

    Minerguard: A solution to detect browser-based cryptocurrency mining through machine learning

    Min-Hao Wu, Yen-Jung Lai, Yan-Ling Hwang, Ting-Cheng Chang, and Fu-Hau Hsu. Minerguard: A solution to detect browser-based cryptocurrency mining through machine learning. Applied Sciences , 12(19), 2022. URL: https://www.mdpi.com/2076-3417/12/19/9838, https://doi.org/10.3390/a...

    2022 doi

  67. [75]

    https://xilinx.github.io/blockchainacceleration/kernel_design.html

    E thash K ernel. https://xilinx.github.io/blockchainacceleration/kernel_design.html. [Accessed 14-04-2025]

    2025

  68. [76]

    Modeling and discovering vulnerabilities with code property graphs

    Fabian Yamaguchi, Nico Golde, Daniel Arp, and Konrad Rieck. Modeling and discovering vulnerabilities with code property graphs. In 2014 IEEE Symposium on Security and Privacy , pages 590--604, 2014. https://doi.org/10.1109/SP.2014.44 doi:10.1109/SP.2014.44

    2014 doi

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.