{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T20:06:09Z","timestamp":1778789169627,"version":"3.51.4"},"publisher-location":"New York, NY, USA","reference-count":64,"publisher":"ACM","license":[{"start":{"date-parts":[[2018,10,15]],"date-time":"2018-10-15T00:00:00Z","timestamp":1539561600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CNS- 1704253"],"award-info":[{"award-number":["CNS- 1704253"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"European Union Horizon 2020","award":["786669"],"award-info":[{"award-number":["786669"]}]},{"name":"DARPA","award":["FA8750-15-2-0084"],"award-info":[{"award-number":["FA8750-15-2-0084"]}]},{"name":"MALPAY"},{"name":"ONR","award":["N00014-17-1-2897"],"award-info":[{"award-number":["N00014-17-1-2897"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2018,10,15]]},"DOI":"10.1145\/3243734.3243858","type":"proceedings-article","created":{"date-parts":[[2018,10,16]],"date-time":"2018-10-16T17:38:33Z","timestamp":1539711513000},"page":"1714-1730","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":109,"title":["MineSweeper"],"prefix":"10.1145","author":[{"given":"Radhesh Krishnan","family":"Konoth","sequence":"first","affiliation":[{"name":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Emanuele","family":"Vineti","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Veelasha","family":"Moonsamy","sequence":"additional","affiliation":[{"name":"Utrecht University, Utrecht, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Martina","family":"Lindorfer","sequence":"additional","affiliation":[{"name":"TU Wien, Vienna, Austria"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christopher","family":"Kruegel","sequence":"additional","affiliation":[{"name":"UC Santa Barbara, Santa Barbara, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Herbert","family":"Bos","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Giovanni","family":"Vigna","sequence":"additional","affiliation":[{"name":"UC Santa Barbara, Santa Barbara, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2018,10,15]]},"reference":[{"key":"e_1_3_2_2_1_1","volume-title":"Crypto Me0wing Attacks: Kitty Cashes in on Monero. https:\/\/www.incapsula.com\/blog\/crypto-me0wing-attacks-kitty-cashes-in-on-monero.html (May","author":"Avital Nadav","year":"2018"},{"key":"e_1_3_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516725"},{"key":"e_1_3_2_2_3_1","volume-title":"Proc. of the USENIX Security Symposium","author":"Borgolte Kevin","year":"2015"},{"key":"e_1_3_2_2_4_1","volume-title":"Proc. of the Network and Distributed System Security Symposium (NDSS)","author":"Canali Davide","year":"2013"},{"key":"e_1_3_2_2_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/2716281.2836098"},{"key":"e_1_3_2_2_6_1","volume-title":"GitHub, Pirate Streaming Sites. https:\/\/www.bleepingcomputer.com\/news\/security\/cryptojackers-found-on-starbucks-wifi-network-github-pirate-streaming-sites\/ (December","author":"Cimpanu Catalin","year":"2017"},{"key":"e_1_3_2_2_7_1","volume-title":"Firefox Working on Protection Against In-Browser Cryptojacking Scripts. https:\/\/www.bleepingcomputer.com\/news\/software\/firefox-working-on-protection-against-in-browser-cryptojacking-scripts\/ (March","author":"Cimpanu Catalin","year":"2018"},{"key":"e_1_3_2_2_8_1","unstructured":"Catalin Cimpanu. Tweak to Chrome Performance Will Indirectly Stifle Cryptojacking Scripts. https:\/\/www.bleepingcomputer.com\/news\/security\/tweak-to-chrome-performance-will-indirectly-stifle-cryptojacking-scripts\/ (February 2018).  Catalin Cimpanu. Tweak to Chrome Performance Will Indirectly Stifle Cryptojacking Scripts. https:\/\/www.bleepingcomputer.com\/news\/security\/tweak-to-chrome-performance-will-indirectly-stifle-cryptojacking-scripts\/ (February 2018)."},{"key":"e_1_3_2_2_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243794"},{"key":"e_1_3_2_2_10_1","volume-title":"Bitcoin ecology: Quantifying and modelling the long-term dynamics of the cryptocurrency market. arXiv:1705.05334v3 {physics.soc-ph} (November","author":"ElBahrawy Abeer","year":"2017"},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW.2018.00014"},{"key":"e_1_3_2_2_12_1","volume-title":"Marie Vasek. The Rise and Fall of Cryptocurrencies. In Proc. of the Workshop on the Economics of Information Security (WEIS)","author":"Feder Amir","year":"2018"},{"key":"e_1_3_2_2_13_1","unstructured":"Dan Goodin. Websites use your CPU to mine cryptocurrency even when you close your browser. https:\/\/arstechnica.com\/information-technology\/2017\/11\/sneakier-more-persistent-drive-by-cryptomining-comes-to-a-browser-near-you\/ (November 2017).  Dan Goodin. Websites use your CPU to mine cryptocurrency even when you close your browser. https:\/\/arstechnica.com\/information-technology\/2017\/11\/sneakier-more-persistent-drive-by-cryptomining-comes-to-a-browser-near-you\/ (November 2017)."},{"key":"e_1_3_2_2_14_1","unstructured":"Dan Goodin. Now even YouTube serves ads with CPU-draining cryptocurrency miners. https:\/\/arstechnica.com\/information-technology\/2018\/01\/now-even-youtube-serves-ads-with-cpu-draining-cryptocurrency-miners\/ (January 2018).  Dan Goodin. Now even YouTube serves ads with CPU-draining cryptocurrency miners. https:\/\/arstechnica.com\/information-technology\/2018\/01\/now-even-youtube-serves-ads-with-cpu-draining-cryptocurrency-miners\/ (January 2018)."},{"key":"e_1_3_2_2_15_1","volume-title":"Chromium Issue 766068: Please consider intervention for high cpu usage js. https:\/\/bugs.chromium.org\/p\/chromium\/issues\/detail?id=766068 (September","year":"2017"},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382283"},{"key":"e_1_3_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23644-0_3"},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3062341.3062363"},{"key":"e_1_3_2_2_19_1","unstructured":"John J. Hoffman Steve C. Lee and Jeffrey S. Jacobson. New Jersey Division of Consumer Affairs Obtains Settlement with Developer of Bitcoin-Mining Software Found to Have Accessed New Jersey Computers Without Users' Knowledge or Consent. https:\/\/nj.gov\/oag\/newsreleases15\/pr20150526b.html (May 2015).  John J. Hoffman Steve C. Lee and Jeffrey S. Jacobson. New Jersey Division of Consumer Affairs Obtains Settlement with Developer of Bitcoin-Mining Software Found to Have Accessed New Jersey Computers Without Users' Knowledge or Consent. https:\/\/nj.gov\/oag\/newsreleases15\/pr20150526b.html (May 2015)."},{"key":"e_1_3_2_2_20_1","volume-title":"Kirill Levchenko. Botcoin: Monetizing Stolen Cycles. In Proc. of the Network and Distributed System Security Symposium (NDSS)","author":"Huang Danny Yuxing","year":"2014"},{"key":"e_1_3_2_2_21_1","unstructured":"Simon Kenin. Mass MikroTik Router Infection -- First we cryptojack Brazil then we take the World? https:\/\/www.trustwave.com\/Resources\/SpiderLabs-Blog\/Mass-MikroTik-Router-Infection-First-we-cryptojack-Brazil -then-we-take-the-World-\/ (August 2018).  Simon Kenin. Mass MikroTik Router Infection -- First we cryptojack Brazil then we take the World? https:\/\/www.trustwave.com\/Resources\/SpiderLabs-Blog\/Mass-MikroTik-Router-Infection-First-we-cryptojack-Brazil -then-we-take-the-World-\/ (August 2018)."},{"key":"e_1_3_2_2_22_1","volume-title":"Who and What Is CoinHive? https:\/\/krebsonsecurity.com\/2018\/03\/who-and-what-is-coinhive\/ (March","author":"Krebs Brian","year":"2018"},{"key":"e_1_3_2_2_23_1","volume-title":"McAfee Labs Threats Report. https:\/\/www.mcafee.com\/us\/resources\/reports\/rp-quarterly-threat-q1--2014.pdf (June","author":"Labs McAfee","year":"2014"},{"key":"e_1_3_2_2_24_1","volume-title":"Pierre-Alain Fouque. Aligot: Cryptographic Function Identification in Obfuscated Binary Programs. In Proc. of the ACM Symposium on Information, Computer and Communications Security (ASIACCS)","author":"Lestringant Pierre","year":"2015"},{"key":"e_1_3_2_2_25_1","volume-title":"Showtime websites secretly mined user CPU for cryptocurrency. https:\/\/www.theverge.com\/2017\/9\/26\/16367620\/showtime-cpu-cryptocurrency-monero-coinhive\/ (September","author":"Liao Shannon","year":"2017"},{"key":"e_1_3_2_2_26_1","volume-title":"UNICEF wants you to mine cryptocurrency for charity. https:\/\/www.theverge.com\/2018\/4\/30\/17303624\/unicef-mining-cryptocurrency-charity-monero\/ (April","author":"Liao Shannon","year":"2018"},{"key":"e_1_3_2_2_27_1","unstructured":"Chaoying Liu and Joseph C. Chen. Cryptocurrency Web Miner Script Injected into AOL Advertising Platform. https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/cryptocurrency-web-miner-script-injected-into-aol-advertising-platform\/ (April 2018).  Chaoying Liu and Joseph C. Chen. Cryptocurrency Web Miner Script Injected into AOL Advertising Platform. https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/cryptocurrency-web-miner-script-injected-into-aol-advertising-platform\/ (April 2018)."},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196542"},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866919.1866929"},{"key":"e_1_3_2_2_30_1","volume-title":"Crypto-Streaming Strikes Back. https:\/\/blog.adguard.com\/en\/crypto-streaming-strikes-back\/ (December","author":"Meshkov Andrey","year":"2017"},{"key":"e_1_3_2_2_31_1","unstructured":"Troy Mursch. Cryptojacking malware Coinhive found on 30 000  Troy Mursch. Cryptojacking malware Coinhive found on 30 000"},{"key":"e_1_3_2_2_32_1","volume-title":"https:\/\/badpackets.net\/cryptojacking-malware-coinhive-found-on-30000-websites\/ (November","year":"2017"},{"key":"e_1_3_2_2_33_1","volume-title":"How to find cryptojacking malware. https:\/\/badpackets.net\/how-to-find-cryptojacking-malware\/ (February","author":"Mursch Troy","year":"2018"},{"key":"e_1_3_2_2_34_1","volume-title":"Bitcoin: A Peer-to-Peer Electronic Cash System. https:\/\/www.bitcoin.org\/bitcoin.pdf","author":"Nakamoto Satoshi","year":"2009"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382274"},{"key":"e_1_3_2_2_36_1","volume-title":"Cryptojacking Attack Found on Los Angeles Times Website. https:\/\/threatpost.com\/cryptojacking-attack-found-on-los-angeles-times-website\/130041\/ (February","author":"O'Donnell Lindsey","year":"2018"},{"key":"e_1_3_2_2_37_1","volume-title":"Over 400 Websites Attacked. https:\/\/threatpost.com\/cryptojacking-campaign-exploits-drupal-bug-over-400-websites-attacked\/131733\/ (May","author":"O'Donnell Lindsey","year":"2018"},{"key":"e_1_3_2_2_38_1","volume-title":"Truth in Web Mining: Measuring the Profitability and Cost of Cryptominers as a Web Monetization Model. arXiv:1806.01994v1 {cs.CR} (June","author":"Papadopoulos Panagiotis","year":"2018"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3178876.3186060"},{"key":"e_1_3_2_2_40_1","volume-title":"Proc. of the USENIX Workshop on Offensive Technologies (WOOT)","author":"Pellegrino Giancarlo","year":"2015"},{"key":"e_1_3_2_2_41_1","volume-title":"https:\/\/thepiratebay.org\/blog\/242 (September","author":"Bay Pirate","year":"2017"},{"key":"e_1_3_2_2_42_1","volume-title":"Proc. of the USENIX Security Symposium","author":"Provos Niels","year":"2008"},{"key":"e_1_3_2_2_43_1","volume-title":"Nagendra Modadugu. The Ghost in the Browser Analysis of Web-based Malware. In Proc. of the Workshop on Hot Topics in Understanding Botnets (HotBots)","author":"Provos Niels","year":"2007"},{"key":"e_1_3_2_2_44_1","volume-title":"Proc. of the ACM Internet Measurement Conference (IMC) (2018","author":"R\u00fcth Jan","year":"1808"},{"key":"e_1_3_2_2_45_1","volume-title":"\u201cSuppress Ads","author":"What","year":"2018"},{"key":"e_1_3_2_2_46_1","volume-title":"Malicious cryptomining and the blacklist conundrum. https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/03\/malicious-cryptomining-and-the-blacklist-conundrum\/ (March","author":"Segura J\u00e9r\u00f4me","year":"2018"},{"key":"e_1_3_2_2_47_1","volume-title":"The state of malicious cryptomining. https:\/\/blog.malwarebytes.com\/cybercrime\/2018\/02\/state-malicious-cryptomining\/ (March","author":"Segura J\u00e9r\u00f4me","year":"2018"},{"key":"e_1_3_2_2_48_1","volume-title":"CryptoNight Hash Function. https:\/\/cryptonote.org\/cns\/cns008.txt (March","author":"Jameson Max","year":"2013"},{"key":"e_1_3_2_2_49_1","volume-title":"Hacked Websites Mine Cryptocurrencies. https:\/\/blog.sucuri.net\/2017\/09\/hacked-websites-mine-crypocurrencies.html (September","author":"Sinegubko Denis","year":"2017"},{"key":"e_1_3_2_2_50_1","volume-title":"Stratum Mining Protocol. https:\/\/slushpool.com\/help\/manual\/stratum-protocol","year":"2016"},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66332-6_13"},{"key":"e_1_3_2_2_52_1","volume-title":"Pulitzer-winning website Politifact hacked to mine crypto-coins in browsers. https:\/\/www.theregister.co.uk\/2017\/10\/13\/politifact_mining_cryptocurrency\/ (October","author":"Thomson Iain","year":"2017"},{"key":"e_1_3_2_2_53_1","unstructured":"Mircea Trofin. Chromium Code Reviews Issue 2656103003"},{"key":"e_1_3_2_2_54_1","volume-title":"Opera introduces bitcoin mining protection in all mobile browsers -- here's how we did it. https:\/\/blogs.opera.com\/mobile\/2018\/01\/opera-introduces-bitcoin-mining-protection-mobile-browsers\/ (January","author":"Viquez Alejandro","year":"2018"},{"key":"e_1_3_2_2_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSPEC.2017.8118483"},{"key":"e_1_3_2_2_56_1","volume-title":"Shuang Hao. SEISMIC: SEcure In-lined Script Monitors for Interrupting Cryptojacks. In Proc. of the European Symposium on Research in Computer Security (ESORICS)","author":"Wang Wenhao","year":"2018"},{"key":"e_1_3_2_2_57_1","volume-title":"HTML Living Standard: Web workers. https:\/\/html.spec.whatwg.org\/multipage\/workers.html","author":"Web Hypertext Application Technology Working Group","year":"2018"},{"key":"e_1_3_2_2_58_1","unstructured":"Chris Williams. UK ICO USCourts.gov... Thousands of websites hijacked by hidden crypto-mining code after popular plugin pwned. http:\/\/www.theregister.co.uk\/2018\/02\/11\/browsealoud_compromised_coinhive\/ (February 2018).  Chris Williams. UK ICO USCourts.gov... Thousands of websites hijacked by hidden crypto-mining code after popular plugin pwned. http:\/\/www.theregister.co.uk\/2018\/02\/11\/browsealoud_compromised_coinhive\/ (February 2018)."},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.56"},{"key":"e_1_3_2_2_60_1","volume-title":"Yandex Browser Strengthens Cryptocurrency Mining Protection. https:\/\/yandex.com\/company\/blog\/yandex-browser-strengthens-cryptocurrency-mining-protection\/ (March","year":"2018"},{"key":"e_1_3_2_2_61_1","volume-title":"Who is Stealing My Power III: An Adnetwork Company Case Study. https:\/\/blog.netlab.360.com\/who-is-stealing-my-power-iii-an-adnetwork-company-case-study-en\/ (February","author":"Zaifeng Zhang","year":"2018"},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663719"},{"key":"e_1_3_2_2_63_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45719-2_6"},{"key":"e_1_3_2_2_64_1","volume-title":"How a URL shortener allows malicious actors to hijack visitors' CPU power. https:\/\/www.helpnetsecurity.com\/2018\/05\/23\/url-shortener-cryptojacking\/ (May","author":"Zorz Zeljka","year":"2018"}],"event":{"name":"CCS '18: 2018 ACM SIGSAC Conference on Computer and Communications Security","location":"Toronto Canada","acronym":"CCS '18","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3243734.3243858","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3243734.3243858","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3243734.3243858","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T00:57:47Z","timestamp":1750208267000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3243734.3243858"}},"subtitle":["An In-depth Look into Drive-by Cryptocurrency Mining and Its Defense"],"short-title":[],"issued":{"date-parts":[[2018,10,15]]},"references-count":64,"alternative-id":["10.1145\/3243734.3243858","10.1145\/3243734"],"URL":"https:\/\/doi.org\/10.1145\/3243734.3243858","relation":{},"subject":[],"published":{"date-parts":[[2018,10,15]]},"assertion":[{"value":"2018-10-15","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}