Detecting and forecasting cryptojacking attack trends in Internet of Things and wireless sensor networks devices

Literature survey

Abbasi et al. (2023) introduced a hybrid detection approach that combines signature-based and behavior-based methods to detect cryptojacking malware in real-time. Their technique was specifically designed to combat in-browser cryptojacking by identifying and blocking known malicious scripts while also monitoring abnormal behavior patterns indicative of cryptojacking. While this method has proven effective in dealing with known threats, it faces significant challenges in maintaining accuracy due to the rapid evolution of cryptojacking techniques, which often bypass traditional detection mechanisms by continuously altering their signature and behavior profiles.

Eskandari et al. (2018) also proposed a hybrid detection system focused on browser-based cryptojacking. Their approach provided valuable insights into the challenges associated with detecting stealthy cryptojacking activities, particularly those that obscure their presence by minimizing CPU usage or spreading their operations across multiple devices. Although their method offers a comprehensive detection framework, it struggles with the inherent difficulty of identifying covert mining activities, which often operate below the detection thresholds of traditional monitoring tools.

Kharraz et al. (2019) developed the Outguard method, a machine learning-based approach aimed at detecting in-browser covert cryptocurrency mining activities. This method leverages a variety of machine learning algorithms to analyze and identify patterns associated with cryptojacking. However, despite its innovative use of machine learning, the approach faces challenges in accurately detecting stealthy mining operations, particularly those that have been optimized to evade traditional anomaly detection techniques.

Gomes & Correia (2020) proposed another machine learning-based detection method that relies on CPU usage metrics to identify cryptojacking activities. By monitoring abnormal spikes in CPU usage, their system can detect when a device is being exploited for unauthorized cryptocurrency mining. However, this approach is prone to generating false positives, especially in environments where legitimate applications may also cause high CPU utilization, thus complicating the differentiation between normal and malicious activities.

Muñoz, Suárez-Varela & Barlet-Ros (2019) explored a network-based approach to cryptojacking detection using NetFlow/IPFIX network measurements. Their method focuses on identifying unusual patterns in network traffic that are indicative of cryptojacking activities, such as sustained high outbound data volumes or frequent connections to cryptocurrency mining pools. While this technique is effective in simpler network environments, it encounters limitations in more complex and highly distributed IoT networks, where the sheer volume of data and the complexity of the network topology can hinder accurate detection.

Androulaki et al. (2018) and Gilad et al. (2017) investigated blockchain-based detection methods, leveraging the decentralized and transparent nature of blockchain technology to enhance cryptojacking detection. Androulaki et al. (2018) utilized Hyperledger Fabric, a permissioned blockchain platform, to improve the traceability and accountability of cryptojacking activities. Similarly, Gilad et al. (2017) proposed using Algorand, a scalable blockchain protocol, to enhance the security and efficiency of cryptojacking detection. While these blockchain-based methods show promise in providing a secure and reliable detection framework, their effectiveness is highly dependent on the specific use cases and requires further validation and adaptation to be applicable in diverse environments, particularly those involving IoT devices.

Despite the progress made by the existing methods, they each exhibit significant limitations that hinder their effectiveness in combating cryptojacking, particularly in IoT and WSN environments. Hybrid methods, while comprehensive, are often outpaced by the rapid evolution of cryptojacking techniques, leading to reduced accuracy over time (Romano, Zheng & Wang, 2020). Machine learning-based approaches, although powerful, tend to produce high false-positive rates in environments with heavy legitimate workloads, making them less reliable in practical applications (Sachan, Agarwal & Shukla, 2022; Xu et al., 2022). Network-based detection methods are limited by the complexity of modern networks, particularly in highly distributed IoT systems where monitoring and analysing all network traffic becomes challenging (Singh et al., 2020). Lastly, blockchain-based detection methods, though innovative, require further adaptation and validation to be effective across different scenarios and use cases, particularly given the resource constraints of IoT devices.

The proposed model in this article seeks to address these limitations by integrating time series analysis with GNNs to not only detect but also forecast cryptojacking attacks. This novel approach shifts the focus from reactive to proactive defence, enabling the prediction of cryptojacking trends before they manifest fully. By analysing temporal patterns in cryptojacking activities and leveraging the relational data modelling capabilities of GNNs, this model can anticipate potential threats, thus providing early warnings and allowing for timely interventions. Additionally, the use of ensemble methods enhances the robustness and accuracy of the predictions, reducing the likelihood of false positives and improving detection in complex IoT and WSN environments. This approach, therefore, not only overcomes the demerits of existing methods but also introduces a new standard in cryptojacking detection, one that is more suited to the dynamic and resource-constrained nature of IoT systems. With a focus on wireless sensor networks and Internet of Things environments, this research introduces a novel method to detect and mitigate cryptojacking, addressing the constraints and insights presented in Table 1, which provides a summary of various cryptojacking detection methods and their effectiveness, as reported in existing literature. This table categorizes the methods into different types such as hybrid, machine learning-based, network-based, and blockchain-based approaches.

Description of the cryptojacking attack timeseries dataset

A useful and specialized source of time series data, the “Cryptojacking Attack Timeseries Dataset” is intended to study the performance of WSN and IoT server instances during cryptojacking attacks and support research and development in real-time detection of the attacks. This dataset includes comprehensive data on metrics for server performance that were gathered during mock cryptojacking attacks. Numerous characteristics pertaining to CPU utilization (Tables 2–4), other performance indicators (Table 5), memory usage (Table 6), and network activity (Table 7), are included. Because every entry in the dataset has a date, it is possible to view performance metrics during the simulated attacks in chronological order and examine the changing trends and features of cryptojacking attacks over time by using this temporal data.

Table 2 offers insights into the CPU utilization metrics during periods when the load on the CPU core exceeded 1. It summarizes key performance indicators such as load_cpucore, which counts the instances when the CPU load was above 1, and load_min1, load_min5, and load_min15, which show the average CPU load over 1, 5, and 15 min, respectively. The data provides an understanding of how the CPU behaves under higher stress conditions, revealing trends and patterns that could be indicative of cryptojacking activities. For instance, the average load over 1 min might spike during an attack, signaling abnormal activity that warrants further investigation.

Table 3 presents similar metrics as Table 2 but focuses on periods when the CPU load was less than or equal to 1. This table is crucial for comparing CPU performance under normal conditions versus high-load conditions (as in Table 2). The statistics include averages, standard deviations, and ranges for the CPU load metrics. For example, the average CPU load (load_min1) is lower, with a smaller standard deviation, indicating more stable performance during these periods. Analyzing these statistics helps in understanding the baseline CPU behavior, which can be contrasted against high-load periods to detect anomalies associated with cryptojacking.

Table 4, displays a range of statistics pertaining to different CPU attributes that were obtained from the “Cryptojacking Attack Timeseries Dataset.” This table includes several CPU-related parameters that provide insights into the distribution of these performance metrics, including:

• Counts for every measure, showing how many occurrences of each CPU feature have been seen.

• The central tendency and data distribution for each feature are provided by the means and standard deviations.

• The range of numbers that indicate the minimum and maximum operating parameters of various CPU functions.

• Quartile values reflect the median (50th percentile), as well as the lower and upper quartiles of the data distribution.

Table 4 details various CPU feature statistics, offering a comprehensive look at the CPU’s performance characteristics over time. This table is crucial for identifying normal operating ranges and detecting deviations that might suggest a cryptojacking attack.

Table 5 provides statistical insights into disk I/O operations, similar to how Table 4 addresses CPU features. This table helps to understand how disk activity is impacted during cryptojacking attacks, as abnormal I/O patterns can be a sign of such malicious activity. This table includes:

• Counts for every measure, which show how many instances of each disc I/O feature have been recorded.

• Means and standard deviations, which show each feature’s central tendency and data distribution.

• Minimum and maximum values that indicate the bounds on which certain disc I/O functions can be used.

• Quartile numbers showing the median (50th percentile) and the lower and upper quartiles of the data distribution.

Table 6 focuses on memory-related metrics, summarizing the distribution and central tendencies of memory usage during the dataset's period. By analyzing counts, means, standard deviations, and range values, this table helps in understanding how memory usage fluctuates during normal operation and potential cryptojacking attacks. High memory usage or unusual memory patterns could indicate the presence of such attacks. This table provides the following statistics:

• Counts for each metric, which indicate how many occurrences of each memory-related trait have been recorded.

• Means and standard deviations, which shed light on each feature’s data distribution and central tendency.

• The lowest and maximum values that indicate the range in which these memory-related functions function.

• Quartile numbers illustrating the data distribution; these include the median (50th percentile) and the lower and upper quartiles.

Table 7 offers a statistical analysis of network-related metrics, providing counts, averages, standard deviations, minimum and maximum values, and quartile values for various network performance indicators. This table is particularly important for understanding how network activity changes during cryptojacking attacks. Abnormal increases in network traffic, unusual patterns, or spikes in specific metrics could be indicative of unauthorized cryptocurrency mining activities, which rely on network resources to communicate with command-and-control servers or mining pools.

By providing detailed statistical summaries of CPU, memory, disk I/O, and network features, these tables collectively help in identifying patterns and anomalies that may indicate cryptojacking attacks, offering a comprehensive view of the system’s performance during such incidents.

The term “CPU_total” refers to a column that holds information on the overall CPU load or usage, which shows how much of the CPU is used overall in a system or computer. As shown in Fig. 2, CPU use is a fundamental indicator used to track the workload and performance of a computer’s CPU. Keeping an eye on this is crucial for a number of reasons, including spotting possible performance bottlenecks, figuring out whether the CPU is being overworked or underutilized, and discovering problems with the responsiveness of the system.

As shown in Fig. 3, the CPU load average over a brief time window—typically one minute—is represented by the ‘load min1’ column. CPU load is a measurement of the amount of processing work the CPU is doing at any one time. It displays the quantity of processes that are awaiting execution in the system’s queue.

The ‘load_min5’ column represents the CPU load average over a medium time window, typically five minutes as depicted in Fig. 4. As with the other load columns, it shows the average number of processes waiting to be executed over a 5-min period.

The ‘load_min15’ column represents the CPU load average over a longer time window, typically fifteen minutes as depicted in Fig. 5. Like load_min1, it measures the average number of processes waiting for execution over a 15-min period. These load averages are crucial metrics for system administrators and performance monitoring because they help in assessing the system’s load and performance. A low load value usually indicates that the system is handling its tasks well and not overloaded, while a high load value may indicate resource contention and possible performance issues.

The ‘Processcount_running’ column likely represents the count of processes that are currently running on the system at a specific moment as depicted in Fig. 6. A running process is a program or task that is currently executing and actively using system resources, such as CPU and memory.

Monitoring the number of running processes is useful for understanding the current workload on the system and assessing its real-time activity. Based on Fig. 7, the “Processcount_total” column most likely indicates the total count of processes on the system, including both operating and non-running (such as sleeping or waiting) processes. It shows the total number of applications or tasks that have been launched or started on the system since its initial boot.

The availability of a well-designed dataset of this kind is essential for testing and comparing novel detection methods and algorithms. By utilizing the performance metrics recorded in this dataset, researchers can develop real-time detection methods with low computational overhead, addressing one of the primary concerns in cryptojacking defense.

Data collection and preprocessing

The dataset utilized in this research comprises three main subsets: final-complete-data-set.csv, final-anormal-data-set.csv, and final-normal-data-set.csv. These datasets were collected from WSN and IoT systems and contain various system attributes relevant to detecting cryptojacking activity. To prepare the data for analysis, several preprocessing steps were performed. Initially, missing values were addressed by removing rows with null values exceeding 15% of the total observations. Subsequently, columns with any remaining missing values were dropped to ensure data integrity.

Furthermore, categorical variables were converted to numeric format to facilitate analysis. Variables were categorized as binary, categorical, float, or integer based on their data types, and irrelevant or redundant features were removed to streamline the dataset. Notably, certain variables related to system resources such as CPU, memory, disk I/O, network activity, file system usage, and process counts were identified and grouped for further analysis. Additionally, flagging mechanisms were implemented to identify anomalous behavior within these resource-related variables, aiding in the detection of potential cryptojacking activity. The flagged records were then analyzed to determine the total number of flags associated with each observation, with a higher flag count indicating a greater likelihood of cryptojacking. Subsequently, a predictive model was developed using the KMeans clustering algorithm based on selected features (fs_/_free, mem_cached, and memswap_free) to further classify potential cryptojacking instances. The steps are described in Algorithm 1.

Exploratory data analysis

Following data preprocessing, exploratory data analysis (EDA) was conducted to gain insights into the distribution and relationships among the selected features. Histograms and pair plots were utilized to visualize the distribution of each feature and explore potential correlations between them. Moreover, the SARIMAX model was employed to analyze the time series data, with the negative log likelihood value indicating the model's suitability for capturing temporal patterns and trends within the dataset. The steps are described in Algorithm 1.

Feature selection process

Feature selection is a critical step in the development of any machine learning model, particularly in the context of cryptojacking detection in IoT and WSN environments. The selection of appropriate features not only improves the model’s performance but also reduces computational complexity, which is essential in resource-constrained environments like IoT networks (Carlin et al., 2019).

First, the potential features were identified by reviewing existing research on cryptojacking detection, cybersecurity, and IoT networks. These features were then categorized into groups like network traffic, device resource usage, and patterns associated with cryptojacking. They were then pre-processed and engineered, missing values were handled, data was normalized, and new features were created to capture more complex patterns. To avoid redundancy, a correlation analysis was conducted and the less important features were discarded.

These features were then ranked using algorithms like Random Forest. Features that consistently ranked high were retained, while those with little predictive power were excluded. To further improve efficiency, dimensionality reduction techniques like principal component analysis (PCA) were applied. Finally, the selected features were validated using cross-validation to ensure their effectiveness in real-world scenarios. Through this rigorous process, the key indicators of cryptojacking, such as sudden spikes in CPU usage, abnormal network traffic patterns, and specific temporal behaviours, were identified. These features were then used as inputs to the proposed model, enabling effective cryptojacking detection in IoT and WSN environments. By carefully selecting and refining the features, the proposed model was able to achieve a balance between accuracy and computational efficiency, making it well-suited for deployment in real-world IoT systems where resources are often constrained. This rigorous feature selection process was instrumental in enhancing the overall performance of the cryptojacking detection model, ensuring that it could operate effectively in diverse and dynamic environments.

Overview regarding selected attributes

The three attributes fs_/_free, mem_cached, and memswap_free themselves do not directly indicate cryptojacking in WSN and IoT (Ali et al., 2020). However, they can be relevant in the context of detecting cryptojacking or any suspicious activities related to it when used in combination with other attributes and behavioral patterns (Androulaki et al., 2018). The meaning of these three attributes is:

• i)

  fs_/_free: This variable represents the amount of free space available in the root filesystem (“/”) of the system (Eskandari et al., 2018). The value of fs_/_free would indicate the available space in this filesystem, which is crucial for proper system functioning (Kharraz et al., 2019) as depicted in Fig. 8.

• ii)

  mem_cached: This variable represents the amount of memory that is used for caching purposes (Eskandari et al., 2018). In modern computer systems, the operating system often uses a portion of the available RAM to cache frequently accessed data (Hasan, Alani & Saad, 2021). This cached data can be quickly retrieved when needed, which can significantly improve system performance. The value of mem_cached would indicate the amount of memory used for caching (Novoa et al., 2022) as depicted in Fig. 9.

• iii)

  memswap_free: This variable represents the amount of free swap space available in the system (Eskandari et al., 2018). Swap space is a portion of the hard drive that is used as virtual memory when the physical RAM is fully utilized (Carlin et al., 2019). When the RAM is full, the operating system moves less frequently used data from RAM to the swap space. The value of memswap_free would indicate how much of the swap space is currently unused and available (Kharraz et al., 2019) as depicted in Fig. 10.

Cryptojacking is the unauthorized use of a victim’s computing resources, such as CPU and memory, to mine cryptocurrencies (e.g., Bitcoin) without the victim’s knowledge or consent (Ali et al., 2020). Here are how these attributes could be related to detecting cryptojacking:

• i)

  High CPU and memory usage: Cryptojacking activities typically consume a significant amount of CPU and memory resources to perform the complex computations involved in cryptocurrency mining (Ali et al., 2020). In the case of cryptojacking, you might observe unusually high values for fs_/_free, mem_cached, and memswap_free attributes as the attacker's mining script utilizes available resources intensively (Ali et al., 2020; Eskandari et al., 2018) as depicted in Fig. 11.

• ii)

  Unusual patterns: Cryptojacking is often stealthy, and attackers may try to mask their activities by mining only during certain periods or when system usage is low (Ali et al., 2020; Kharraz et al., 2019). Therefore, monitoring the variations in these attributes over time might reveal patterns that are inconsistent with normal system usage (Ali et al., 2020; Kharraz et al., 2019). Sudden spikes in CPU and memory usage or unexpected changes in free space might indicate malicious activities (Ali et al., 2020) as depicted in Fig. 11.

• iii)

  Abnormal persistence: Cryptojacking malware often runs persistently in the background to continuously mine cryptocurrencies (Ali et al., 2020; Eskandari et al., 2018). As a result, the CPU and memory usage may remain high for prolonged periods, even when the system is otherwise idle (Ali et al., 2020; Eskandari et al., 2018). This abnormal persistence could be another indication of cryptojacking (Ali et al., 2020) as depicted in Fig. 11.

• iv)

  Anomalous network traffic: Although the provided attributes are related to system resources, monitoring network traffic patterns can also be crucial in detecting cryptojacking (Ali et al., 2020; Hasan, Alani & Saad, 2021). Cryptojacking malware communicates with external mining pools or command-and-control servers, resulting in anomalous network traffic (Ali et al., 2020; Hasan, Alani & Saad, 2021). Correlating resource usage with network traffic patterns can strengthen the detection of cryptojacking (Ali et al., 2020; Hasan, Alani & Saad, 2021) as depicted in Fig. 11.

Proposed work

The proposed research aims to develop an effective model for attribute prediction in cryptocurrency systems, especially in WSN and IoT devices to enable better monitoring and management of these systems (Ali et al., 2020). Algorithm 2 provides a high-level overview to help in replacting and developing the proposed model. The focus will be on predicting various performance metrics, such as CPU usage, memory utilization, disk I/O, and network activity (Kharraz et al., 2019; Eskandari et al., 2018). To guarantee the accuracy and dependability of the predictive models, it is crucial to assure the quality of the data and to prepare it in the right format (Kharraz et al., 2019).

Two distinct models were investigated for attribute prediction:

1. Autoregressive Integrated Moving Average (ARIMA): A popular time-series forecasting model that reflects the temporal interdependence in the data is the Autoregressive Integrated Moving Average (ARIMA) (Kharraz et al., 2019). It will be used to model past bitcoin characteristic patterns and forecast future developments based on trends seen thus far (Ali et al., 2020).

2. Graph Neural Network (GNN): GNN is an effective model for representing intricate relationships seen in data that resembles a graph (Kharraz et al., 2019). The cryptocurrency system’s attributes and their linkages can be represented as a graph in this context, and a GNN will be trained to identify underlying patterns and interactions between these attributes (Ali et al., 2020).

To learn from past patterns and attribute connections, pre-processed bitcoin data will be used to train both ARIMA and GNN (Apostolaki, Zohar & Vanbever, 2017). The predictions from ARIMA and GNN will be combined using an average method to build an ensemble model following the training of the individual models (Kharraz et al., 2019). The goal is to use the advantages of both models to provide an attribute prediction that is more reliable and accurate (Kharraz et al., 2019). Several measures, including accuracy, MSE, MAE, and RMSE, will be used to assess the performance of the individual models and the ensemble model (Kharraz et al., 2019). The results of this research may also have a big impact on cryptocurrency systems in the real world by facilitating effective resource management, anomaly detection, and attribute-based decision-making (Ali et al., 2020).

Overview and architecture of the models

ARIMA model

The ARIMA model combines moving averages, differencing, and autoregression to produce precise forecasts, which makes it perfect for trend and seasonality-driven data analysis. As seen in Fig. 12, the model is specified by three parameters: p, d, and q (Novoa et al., 2022).

• i)

  The number of lag observations in the model that captures the relationship between the target variable and its historical values is indicated by the p parameter (AR- Autoregressive). ‘order = (1, 1, 1)’ in the above code indicates that there is one autoregressive term (Novoa et al., 2022).

• ii)

  The number of differencing steps required to remove trends and seasonality from the data and make it steady is represented by the d parameter (I-Integrated). According to the code, there is only one differencing step (‘order = (1, 1, 1)’ (Novoa et al., 2022).

• iii)

  The size of the moving average window, which captures the relationship between the target variable and its historical forecast mistakes, is determined by the q parameter (MA = Moving Average). Once more, the code’s ‘order = (1, 1, 1)’ indicates that the ARIMA model contains a single moving average term (Novoa et al., 2022).

The model focuses on attributes like ‘cpu_total’, ‘load_min1’, ‘load_min15’, ‘load_min5’, ‘processcount_running’, and ‘processcount_total’ when choosing pertinent columns from the dataset for analysis and forecasting before implementing the ARIMA model (Novoa et al., 2022). To appropriately assess the model’s performance, the data is then split into two sets: a test set (20% of the data) and a training set (80% of the data). The ARIMA model is fitted to the training data for each attribute, with the order set to (1, 1, 1). Next, using the ‘forecast’ method, predictions are made on the test data using the fitted ARIMA model. Lastly, the performance of the ARIMA model for each attribute is determined by calculating the MAE. The average absolute difference (AED) between the actual and anticipated values is a measure of the forecasting accuracy of the model.

GNN model

A deep learning architecture created especially for processing and learning from graph-structured data is the GNN model. As shown in Fig. 13, this architecture is particularly useful for handling data that shows complex interactions between items represented as nodes and edges in a graph (Abbasi et al., 2023). The GNN architecture employed in the provided code consists of two graph convolutional layers (GCN layers). These GCN layers are the core components of GNNs, responsible for aggregating information from neighboring nodes in the graph to update the feature representations of each node. The first GCN layer takes the input features (node attributes) and edge connections (adjacency matrix) as input and outputs updated feature representations for each node. The second GCN layer further refines these node representations. To introduce non-linearity and enhance the expressive power of the model, ReLU is used as the activation function after each GCN layer (Ali et al., 2020; Abbasi et al., 2023).

Ensemble model

As shown in Fig. 14, the ensemble model is a potent method that improves prediction performance by integrating the advantages of two models: the GNN model (Ali et al., 2020) and the ARIMA model (Novoa et al., 2022). The algorithm uses a simple averaging technique to accomplish this, scaling the ARIMA and GNN forecasts to correspond with the test data’s length (Ali et al., 2020; Novoa et al., 2022). Metrics like MSE, MAE, RMSE, and accuracy—which calculates the proportion of accurate predictions over actual labels—are then used by the ensemble model to evaluate its performance (Ali et al., 2020; Novoa et al., 2022).

Using both graph-based deep learning (GNN) (Ali et al., 2020) and time series modelling (ARIMA) (Novoa et al., 2022), the ensemble approach seeks to increase forecasting accuracy and robustness for the target variable (flag) in the dataset. This combination approach's success may be evaluated by comparing the ensemble model’s performance with that of the separate ARIMA and GNN models (Ali et al., 2020; Novoa et al., 2022). In general, the ensemble model leverages the complimentary characteristics of each component model to produce predictions that are more accurate (Ali et al., 2020; Novoa et al., 2022).

Time series model

The application of the ARIMA-based time series model has exhibited impressive predictive capabilities across the targeted attributes. Demonstrating robust accuracy, the model performed exceptionally well, achieving high accuracy scores ranging from approximately 98.73% to 99.98%, illustrated in Figs. 10 and 11. The model's performance merits attention, particularly in its predictions for specific attributes:

• ‘cpu_total’: Displayed in Fig. 15

• ‘load_min1’: Presented in Fig. 16

• ‘load_min5’: Depicted in Fig. 17

• ‘load_min15’: Shown in Fig. 18

• ‘processcount_running’: Visualized in Fig. 19

• ‘processcount_total’: Elucidated in Fig. 20

The model’s exceptional accuracy underscores its proficiency in discerning underlying patterns and temporal trends within the time series data. Its precision in forecasting future data points showcases its adeptness in capturing intricate system behaviors.

A residual plot in the context of time series analysis, as shown here for the ARIMA model, visualizes the differences between the actual observed values and the predicted values produced by the model. In this plot:

• X-axis (Date): Represents the timeline or sequence of time points for which predictions were made.

• Y-axis (Residual Error): Indicates the discrepancy between the actual value and the predicted value at each corresponding time point. The residual error is calculated as the actual value minus the predicted value.

Interpreting the residual plot involves assessing whether the residuals exhibit any patterns or trends over time. The plot illustrated in Fig. 21 exhibits that the residuals are randomly scattered around the zero line without any discernible pattern, it indicates that the model captures the underlying data patterns well, and there are no systematic errors left unaccounted for.

GNN model

The GNN model has undergone rigorous evaluation, primarily focusing on MAE assessment across multiple attributes. Across attributes such as ‘cpu_total’, ‘load_min1’, ‘load_min15’, ‘load_min5’, ‘processcount_running’, and ‘processcount_total’, the GNN model exhibited comparatively low MAE values. This suggests a noteworthy accuracy in predictions, as depicted in Figs. 22 and 23. The model achieved an accuracy of approximately 87.25%, indicating its proficient predictive abilities. While the achieved accuracy is commendable, it is noteworthy that the GNN model’s performance heavily relies on data representation, graph structure, and hyperparameter tuning. Figures 22 and 23 illustrate the ROC curve and precision-recall curve, respectively, portraying the model’s predictive capabilities and emphasizing the need for ongoing refinements to maximize its potential. The model’s implementation offers a novel approach in identifying intricate interdependencies and correlations between diverse variables, enhancing the understanding of system behavior (Ali et al., 2020).

Ensemble model

The ensemble model’s primary purpose is to combine the predictions from different models to improve overall performance. The ensemble model’s predictions are in close agreement with the actual values, as evidenced by the comparatively low MSE, MAE, and RMSE values. As presented in Table 8 as well as Figs. 24 and 25, the ensemble accuracy, at roughly 90.97%, is marginally lower than the time series model but higher than the GNN model. This shows that to produce reliable and accurate predictions for the chosen qualities, the ensemble model has effectively taken advantage of the advantages of the individual models.

The time series model can effectively capture patterns and trends in system behavior, assisting in the identification of abnormal spikes or sudden fluctuations that may indicate cryptojacking activity, as demonstrated by the high accuracy it as shown in Fig. 24. Additionally, the Ensemble model’s GNN component offers a novel method for identifying minute dependencies and correlations between various variables, giving a comprehensive understanding of the behavior of the system (Ali et al., 2020). With an overall accuracy of about 91% (Ali et al., 2020), as shown in Fig. 25, the Ensemble model is a good choice for early detection applications due to its robustness and generalization over a range of system parameters.

Additionally, the suggested method's adaptability to various system architectures and contexts makes it simple to use in a wide range of sectors (Ali et al., 2020). The integration of GNNs with time series modelling in an Ensemble model provides a potent and proactive defense against cryptojacking attempts, particularly while the cyber threat landscape is constantly changing (Carlin et al., 2019; Hasan, Alani & Saad, 2021).

Table 9 is a comparison table that shows the accuracy of each attribute for the different models used (ARIMA, GNN, and the Ensemble model). This table provides a side-by-side comparison of how each model performed across various attributes. It is crucial for understanding how each model contributes to the overall performance of the proposed cryptojacking detection method. The GNN model consistently achieved 100% accuracy across all attributes, including cpu_total and processcount_total, indicating that it effectively captured the relevant patterns in the time series data without any loss in accuracy. This shows the GNN model’s robustness and strong capability in handling the dataset. While the ARIMA model generally performed very well, achieving 100% accuracy for most attributes. However, its accuracy slightly reduced to approximately 98.5% for the cpu_total and processcount_total attributes. This slight drop suggests that while ARIMA is highly effective, it may have a minor limitation in predicting these specific attributes compared to the GNN model. The ensemble model, which combines the predictions from both GNN and ARIMA, shows slightly lower accuracy (~95%) across all attributes. However, the ensemble model remains a valuable component of the cryptojacking forecasting methodology despite its slightly lower accuracy compared to the GNN model alone. Ensemble methods are designed to combine the strengths of multiple models, in this case, leveraging the GNN’s ability to capture complex patterns and ARIMA’s strength in handling temporal dependencies. This combination enhances the model’s robustness and generalizability, making it more reliable in diverse and evolving real-world scenarios. The slight reduction in accuracy can be viewed as a trade-off for increased stability and reduced variance, ensuring that the ensemble model remains effective across a broader range of situations, especially where data patterns may vary or evolve over time. Therefore, the ensemble model provides a balanced and robust approach, reinforcing the overall resilience and reliability of the cryptojacking detection system.

Discussion on findings and their impact

The findings from the analysis are highly relevant to the broader goal of forecasting cryptojacking attacks, which is a critical challenge in cybersecurity. The research set out to develop a robust, real-time detection method capable of forecasting cryptojacking activities with high accuracy, even as these attacks evolve in complexity. The results demonstrate that the proposed models, particularly the GNN and the ensemble approach, are effective in achieving this objective.

The GNN model’s consistent 100% accuracy across all performance metrics, such as ‘cpu_total’ and ‘processcount_total’, highlights its capability to accurately capture and predict the patterns associated with cryptojacking activities. This is crucial in a real-world scenario where timely and precise forecasting can prevent significant resource misuse and potential financial losses. The high accuracy of the GNN model indicates that it can reliably forecast cryptojacking attacks by identifying the subtle and complex patterns that precede such activities, thus providing early warnings and allowing for prompt defensive actions. On the other hand, the ensemble model, while showing slightly lower accuracy, remains relevant as it combines the strengths of both GNN and ARIMA models. This combination is particularly important for generalizability and stability across varied datasets, which is a key research objective. The ensemble model’s slightly reduced accuracy can be seen as a minor trade-off for the broader applicability and resilience it offers, especially in forecasting scenarios where data might exhibit unexpected patterns or where different types of cryptojacking attacks might emerge. The models’ ability to forecast cryptojacking attacks effectively reinforces the practical applicability of the proposed methodology in real-time cybersecurity frameworks, making a significant contribution to the ongoing efforts in enhancing the security of web systems and IoT environments.