Automatic and Robust Fingerprinting of In-browser Cryptominers

The Hong Kong University of Science and Technology
Department of Computer Science and Engineering


MPhil Thesis Defence


Title: "Automatic and Robust Fingerprinting of In-browser Cryptominers"

By

Mr. Tanapoom SERMCHAIWONG


Abstract:

This thesis addresses an illicit activity facilitated by cryptocurrencies 
called "cryptojacking", an attack that uses stolen computing resources to 
mine cryptocurrencies without consent for profit. In-browser cryptojacking 
malware exploits high-performance web technologies such as WebAssembly to 
mine cryptocurrencies directly within the browser without file downloads. 
Existing methods for cryptomining detection report high accuracy and low 
overhead but are often susceptible to various forms of obfuscation, and due 
to the limited variety of cryptomining scripts in the wild, standard code 
obfuscation methods present a natural and appealing solution to avoid 
detection. To address these limitations, we propose using instruction-level 
data-flow graphs to detect cryptomining behavior. Data-flow graphs offer 
detailed structural insights into a program's computations, making them 
suitable for characterizing proof- of-work algorithms, but they can be 
difficult to analyze due to their large size and susceptibility to noise and 
fragmentation under obfuscation. We present two techniques to simplify and 
compare data-flow graphs: (1) a graph simplification algorithm to reduce the 
computational burden of processing large and granular data-flow graphs while 
preserving local substructures; and (2) a subgraph similarity measure, the 
n-fragment inclusion score, based on fragment inclusion that is robust 
against noise and obfuscation. Using data-flow graphs as computation 
fingerprints, our detection framework PoT (Proof-of-Theft) was able to 
achieve high detection accuracy against standard obfuscations, outperforming 
existing detection methods.


Date:                   Wednesday, 17 June 2026

Time:                   3:00pm - 5:00pm

Venue:                  Room 5501
                        Lifts 25/26

Chairman:               Dr. Shuai WANG

Committee Members:      Dr. Jiasi SHEN (Supervisor)
                        Prof. Charles ZHANG