Adaptive sequential threshold analysis of cryptojacker sings based on the criterion of maximizing statistical distinguishability by Bhattacharyya distance

An adaptive sequential analysis of three behavioral signs of cryptojackers is presented - high values of processor system load, external network traffic and the intensity of calling crypto libraries, the simultaneous combination of which is an unlikely event for “legitimate” user computing processes. The facts of the manifestation of signs are recorded by exceeding certain thresholds by the marked values, which adapt to the statistics of the corresponding parameters of the computational processes of cryptojackers and “legitimate” numerical processes of a particular user computer device. Statistics of computational processes are formed in the form of frequency histograms of the values of the corresponding parameters. The determination of adapted thresholds is carried out according to the criterion of minimizing the Bhattacharyya statistical distance between the frequency histograms of the values of the corresponding parameters of cryptojackers and “legitimate” user computing processes.