상세정보

Notwithstanding the anticipated positive effects of the browser-based cryptomining , such as the alternative to online advertisements, it is often utilized for attackers to gain profits by exploiting users’ resources without their consent, called cryptojacking . Previous approaches attempted to protect user’s resources by filtering out cryptojacking websites have limitations. Some of them are easily bypassed by evasion techniques (e.g., script code obfuscation), and the others report numerous false alarms, because they only focused on a few characteristics of cryptojacking , e.g., high computational resource usage, which is common in modern websites. In this paper, we propose Circuit , a precise approach for detecting cryptojacking websites. We mainly focus on the JavaScript memory heap, which is not only resilient from the script code obfuscation, but also provides the declared objects information in the script code and their reference relationships. Using the pieces of information provided by the JavaScript memory heap, we generate a reference flow, which can represent the script code behavior of the website. Hence, Circuit determines that a website is running cryptojacking if the website contains a reference flow of cryptojacking . When we applied Circuit on 300K real-word websites including the Alexa top 100K and Majestic top 200K websites, we found 13 real-world cryptojacking websites. even though most of them were applying evasion techniques to avoid cryptojacking detection. By modeling the identified evasion techniques and providing the fact that what was known to be characteristic of cryptojacking websites now frequently appear on normal websites, we deliver new insights into cryptojacking .

Introduction 1
2 Background and Related Work 5
2.1 Background knowledge 5
2.1.1 Cryptomining 5
2.1.2 Cryptojacking 6
2.1.3 Web worker 7
2.2 Related work 9
3 Circuit : Design and Implementation 12
3.1 Overview 12
3.2 Generating heap graph 15
3.2.1 Reference in JavaScript 15
3.2.2 Prototype in JavaScript 16
3.2.3 Heap graph construction 17
3.3 Extracting reference flows 19
3.4 Detecting cryptojacking 21
4 Evaluation and Findings 23
4.1 Detection of cryptojacking in the real-world websites 25
4.2 Evasion techniques 28
4.3 Distribution of websites with web workers 30
4.4 Websites with multi-services 31
5 Discussion and Future work 34
5.1 Detection based on the memory heap 34
5.2 Limitations 35
5.3 Future work 36
6 Conclusion 37
Bibliography 38