  Traffic monetization is a crucial component of running most for-profit online
businesses. One of its latest incarnations is cryptocurrency mining, where a
website instructs the visitor's browser to participate in building a
cryptocurrency ledger (e.g., Bitcoin, Monero) in exchange for a small reward in
the same currency. In its essence, this practice trades the user's electric
bill (or battery level) for cryptocurrency. With user consent, this exchange
can be a legitimate funding source - for example, UNICEF has collected over 27k
charity donations on a website dedicated to this purpose, thehopepage.org.
Regrettably, this practice also easily lends itself to abuse: in this form,
called cryptojacking, attacks surreptitiously mine in the users browser, and
profits are collected either by website owners or by hackers that planted the
mining script into a vulnerable page. Cryptojackers have been bettering their
evasion techniques, incorporating in their toolkits domain fluxing, content
obfuscation, the use of WebAssembly, and throttling. Whereas most
state-of-the-art defenses address multiple of these evasion techniques, none is
resistant against all. In this paper, we offer a novel detection method,
CoinPolice, that is robust against all of the aforementioned evasion
techniques. CoinPolice flips throttling against cryptojackers, artificially
varying the browser's CPU power to observe the presence of throttling. Based on
a deep neural network classifier, CoinPolice can detect 97.87% of hidden miners
with a low false positive rate (0.74%). We compare CoinPolice performance with
the current state of the art and show our approach outperforms it when
detecting aggressively throttled miners. Finally, we deploy Coinpolice to
perform the largest-scale cryptoming investigation to date, identifying 6700
sites that monetize traffic in this fashion.
