{"id":"74a7117d-7262-449c-bb9d-5d2637d6ed5d","arxiv_id":"2505.02493","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"PoT detects obfuscated in-browser cryptominers by comparing simplified data-flow graph fingerprints with known miners, reporting 98.3% accuracy on a 65-sample benchmark.","lead":"This paper proposes a new detection method for hidden browser-based cryptocurrency miners that uses the shape of data flow inside a program, not its text or network traffic. The method simplifies large data-flow graphs into compact fingerprints and checks for fragments of known mining patterns, achieving high accuracy on a small benchmark including obfuscated miners.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed 98.3% accuracy rests on a 0.011 threshold margin from stochastic n-FIS estimates; different random seeds can flip the decisive classifications.","rationale":"The reader's weakest assumption concerns the choice of only three instrumented instructions (and, shr, xor). That is a real limitation, but it is a forward-looking evasion concern: the evaluated obfuscations do not remove those opcodes, and proof-of-work hashing inherently relies on bitwise operations. The more pressing problem is internal to the reported evaluation. The n-FIS score is a stochastic estimate with no reported variance, and the decisive margin between the best benign score and the threshold is 0.011, smaller than one standard error of the estimate. The same applies to the closest true positive. Thus the paper's headline numbers could be an artifact of one random draw, not a robust property of the method. This is directly testable by reseeding the pipeline, and it does not require any new adversarial assumption. The paper has genuine strengths: the graph-simplification idea is novel, the ablation shows simplification helps, and the comparison to MINOS, Minesweeper, and WASim is useful. Conditional acceptance remains appropriate, but the condition should be demonstrating that the reported separation is stable across random seeds, not merely that a single run achieves 98.3%.","tokens_in":28157,"tokens_out":6067,"duration_ms":83486,"concrete_test":"Run the complete PoT pipeline (Algorithm 1 random walks, mean-shift grouping, and Algorithm 2 with k=500) 100 times with different random seeds on the same 65-sample benchmark, keeping the 0.65 threshold fixed. Record the distributions of accuracy, sensitivity, and specificity, and specifically check whether factorial's wmp score crosses 0.65 or btc-emccobf-split's btc score falls below 0.65 in more than 5% of runs. If labels flip, report confidence intervals for all Table 6 scores within 0.05 of the threshold and replace the headline point estimate with a range.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline result is not stable under the method's own randomness. The n-FIS score (Definition 10, Algorithm 2) is estimated by drawing k=500 random connected n-edge subgraphs, and the simplified fingerprints themselves come from random backward walks (Algorithm 1). Table 6 shows that at the chosen 0.65 threshold, the closest benign score is factorial vs. wmp at 0.639 (margin 0.011), and the closest true positive is btc-emccobf-split vs. btc at 0.653 (margin 0.003). For a binomial estimate with k=500, a score near 0.65 has a standard error of about 0.021, so each of these decisive classifications has a roughly 30-44% chance of flipping on an independently seeded rerun. The paper reports no random seed, no confidence intervals, and no repeated-run variance. Because the threshold was also selected on the same data, the 98.3% accuracy, 100% specificity, and 96.7% sensitivity in Table 7 are point estimates from a single stochastic draw. This directly undermines the central empirical claim that the n-fragment inclusion score robustly separates obfuscated miners from benign applications.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript presents PoT, a dynamic-analysis framework that detects in-browser WebAssembly cryptominers by (i) building instruction-level data-flow graphs from executions of three Wasm opcodes (and, shr, xor), (ii) simplifying these graphs with a random-backward-walk approximate merge of isomorphic rooted subgraphs, and (iii) classifying a sample by its n-fragment inclusion score against a database of simplified miner fingerprints. The authors report 98.3% accuracy, 96.7% sensitivity, and 100% specificity at a 0.65 threshold on a 65-sample benchmark (6 open-source miners, 30 obfuscated variants, 29 benign web apps), outperforming MINOS, Minesweeper, and WASim. The paper also contributes theorems relating backward-walk visit probabilities to isomorphic rooted subgraphs and a synthetic-family analysis of the simplification approximation.","tokens_in":28412,"tokens_out":6956,"duration_ms":84866,"significance":"If the reported results were robust, PoT would be a meaningful step for obfuscation-resilient cryptojacking detection: it uses a genuinely different signal (dynamic data-flow structure rather than instruction counts or binary images), the simplification idea is plausible, and the n-FIS measure is well motivated for fragmented graphs. The comparison against three prior systems is also useful. The paper is honest about the low diversity of real-world miners and the signature-database limitation. The main strengths are the formalization of the simplification step (Theorems 5, 8, 9) and the concrete evaluation against baselines on a documented benchmark. However, the current evaluation is too in-sample and too small to support the headline performance numbers, and some reported numbers are internally inconsistent. The central idea is defensible, but the evidence needs substantial strengthening.","major_comments":[{"comment":"The detection threshold (0.65) and the hyperparameters n=5 and k=500 are selected using the same 65-sample benchmark on which Table 7 reports performance; §4.3 states that n and k were 'chosen based on evaluation', and §6.3.1 introduces the 0.65 threshold as an 'empirical decision boundary'. Consequently, the 98.3% accuracy is a resubstitution estimate, not a prediction on unseen data. The authors should evaluate with a held-out set, cross-validation folds, or at minimum select the threshold on a training split and report performance on untouched samples. Without this, the headline comparison against the baselines is not a fair test of generalization.","section":"§4.3 and §6.3, Table 7"},{"comment":"The n-FIS score is a stochastic estimate: Algorithm 2 draws only k=500 random connected subgraphs, and Algorithm 1 itself uses random backward walks. Table 6 shows that the two decisive classifications at the 0.65 threshold are very close to the boundary: benign 'factorial' scores 0.639 against 'wmp' (margin 0.011), and 'btc-emccobf-split' scores 0.653 against 'btc' (margin 0.003). For a binomial estimate with k=500 and p near 0.65, the standard error is about 0.021, so each of these decisions has a substantial probability of flipping under an independent reseeding. The paper reports no random seed, no confidence intervals, and no repeated-run variance, so the claimed 98.3% accuracy, 96.7% sensitivity, and 100% specificity are point estimates from a single stochastic draw. The authors should report means and variances over multiple runs, or replace the estimate with exact n-FIS values for the small simplified graphs.","section":"Definition 10, Algorithm 2, Table 6"},{"comment":"The confusion matrix implied by Table 6 at the 0.65 threshold does not match the metrics in Table 7. With one missed obfuscated sample out of 36 total miners and all 29 non-miners correctly rejected, the counts are TP=35, FN=1, TN=29, FP=0, giving accuracy 64/65 = 98.5%, sensitivity 35/36 = 97.2%, and F1 = 70/71 = 98.6%, not 98.3%, 96.7%, and 98.3%. The value 96.7% corresponds to 29/30 obfuscated samples, suggesting the sensitivity is computed only over the obfuscated subset while the accuracy is computed over all 65 samples. The authors should recompute all metrics from a single, explicitly stated confusion matrix and make the denominator clear.","section":"Table 7 vs. Table 6"},{"comment":"The validation of the approximation quality is not quantitatively supported. Theorems 8 and 9 show only that the exact and approximate simplified graphs are contained in the universal graph G_N; they do not show that the approximate simplification is close to the exact simplification. The subsequent claim that 'about 90% of all H in H4 are also in A4' is based on an unspecified random sample of H4, with no sample size, sampling procedure, or confidence interval reported (and E4 and A4 are related to H4 in a way that does not directly yield the stated 90% figure). Because RQ1's argument that simplification 'preserves local substructures' relies on this approximation, the authors should provide a reproducible, statistically grounded analysis, ideally with exact enumeration for the small cases or a rigorous bound for the graphs that occur in the benchmark.","section":"§4.2.1, Theorems 8–9"}],"minor_comments":[{"comment":"The abstract contains the typo 'then-fragment inclusion score' instead of 'n-fragment inclusion score', and §6.4 contains 'precense' instead of 'presence'.","section":"Abstract and §6.4"},{"comment":"The text in §6.3.1 states a sensitivity of 96.6%, while Table 7 reports 96.7%; since 29/30 = 96.7%, the text should use a consistent figure or explain the discrepancy.","section":"§6.3.1 and Table 7"},{"comment":"The statement that 'the graphs in our experiment have up to 1000 nodes and 2000 edges' is contradicted by Table 3, where several samples (e.g., cn-emccobf-substitute, xmr-emccobf-substitute) have over 2000 vertices.","section":"§4.2.1 and Table 3"},{"comment":"The claim that this is 'the first to utilize instruction-level data-flow graphs in either detecting cryptominers or software classification in general' is in tension with the cited Anderson et al. [2] work on instruction-level resource graphs and Markov chains, as well as with earlier graph-based malware detection surveyed in §2.3. The novelty claim should be narrowed to 'the first to use instruction-level data-flow graphs for cryptominer detection' or otherwise qualified.","section":"Introduction and §2.3"},{"comment":"The evaluation section does not state a random seed for the stochastic algorithms and does not mention an artifact release. Providing a seed, repeated-run statistics, and an artifact link would substantially improve reproducibility and would directly address the stability concern raised in the major comments.","section":"§6.1"}],"recommendation":"major_revision","confidential_remarks":"The core idea is interesting and worth pursuing, but the reported numbers are not yet reliable: the evaluation is in-sample, the stochastic estimation has not been characterized, and some metrics are internally inconsistent. I would not consider acceptance until the evaluation is re-run with proper validation and uncertainty reporting. I also note that the paper does not currently state an artifact-availability plan, which is increasingly expected for a systems/security paper of this type."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper is worth a serious look. The core idea—build instruction-level data-flow graphs, simplify them by merging vertices with equal backward-walk probabilities at the same depth, then compare via a fragment-inclusion score—is genuinely new in this space, and the simplification is clever. Applying this to WebAssembly cryptominers is a real contribution, and the authors are honest that it's a fingerprinting scheme with a database that needs maintaining.\n\nWhat's solid: The graph simplification is well-motivated, the n-FIS measure is sensible for noisy and obfuscated graphs, and the authors include a useful ablation (simplified vs. unsimplified). They also compare against four baselines on a real-world Wasm benchmark set, which is more than many papers do. The limitations section is candid about the need for a fingerprint database and about programs with diverse computations.\n\nNow the soft spots, in proportion. The evaluation is small—6 miners, 30 obfuscated variants, 29 benign apps—and the 0.65 threshold is chosen on the same data. That's a standard weakness, but here it's compounded by the fact that the n-FIS scores are stochastic estimates (k=500 random fragments; random walks in simplification) with no seed, no confidence intervals, and no repeated runs. The stress-test note is correct: the closest benign score (factorial vs. wmp, 0.639) is within 0.011 of the threshold, and the closest true positive (btc-emccobf-split vs. btc, 0.653) is within 0.003. With a binomial standard error around 0.021, each of those classifications has a 30-44% chance of flipping on an independent rerun. The claimed 98.3% accuracy is a point estimate from one stochastic draw. That doesn't kill the method, but it means the headline number isn't robust yet.\n\nOther issues are minor: the text says graphs have 'up to 1000 nodes and 2000 edges' while Table 3 lists several graphs over 1300 vertices—small inconsistency. The approximation-quality proof only covers a small synthetic graph family (depth ≤4, ≤80 vertices), and the '90%' claim is based on an unspecified random sample. The reliance on just three instrumented instructions (and, shr, xor) is a real limitation, though it's grounded in Seismic's findings and the authors acknowledge it.\n\nWho it's for: researchers working on cryptojacking detection or obfuscation-resistant malware analysis. It deserves a serious referee—the idea is fresh and the presentation is clear—but the empirical claims need a robustness pass: multiple seeds, confidence intervals, and ideally a threshold selected on a separate validation set. I'd be inclined to accept conditionally.","headline":"A genuinely new graph-fingerprinting idea for cryptojacking detection, but the headline accuracy rests on a razor-thin margin over stochastic noise and needs a robustness pass before I'd trust the numbers.","tokens_in":28892,"tokens_out":2638,"would_cite":true,"duration_ms":29871,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PoT (Proof-of-Theft), a detector that fingerprints WebAssembly programs by the flow of data into three bitwise instructions, reports 98.3 percent accuracy at spotting obfuscated in-browser cryptominers.","keywords":["software security","cryptocurrency","malware detection","dynamic analysis","data-flow graph","WebAssembly","cryptojacking","obfuscation"],"falsifier":"Rewrite one of the six miners so that its hash loop performs the same bit operations without ever using and, shr, or xor (for example, via arithmetic identities or lookup tables), run it through the full PoT pipeline, and check whether any n-FIS score stays above 0.65; if the score falls below the threshold, the fingerprint is evadable by construction and the claimed accuracy is specific to the tested opcode footprint.","tokens_in":27935,"feed_emoji":"⛏️","tokens_out":19598,"duration_ms":186922,"temperature":0.7,"pith_summary":"This paper tries to establish that instruction-level data-flow graphs, traced from WebAssembly execution, can fingerprint cryptomining computation well enough to survive standard obfuscation. It proposes two techniques: a graph-simplification algorithm that merges repeated substructures at the same depth to shrink graphs by more than 97 percent, and the n-fragment inclusion score, which measures how often small connected pieces of a known miner's graph appear inside a sample. On a benchmark of six miners, thirty obfuscated variants, and twenty-nine benign WebAssembly applications, the combined framework PoT reports 98.3 percent accuracy at a 0.65 threshold, with 100 percent specificity, outperforming three prior detectors. This matters because existing detectors based on instruction counts, binary images, or file metadata are known to be evadable, while the repeated hashing computation at the heart of proof-of-work is harder to disguise.","feed_headline":"Data-flow graphs catch obfuscated crypto miners at 98.3% accuracy","feed_subtitle":"The detector reads how data moves between instructions, so obfuscation that reshapes the binary cannot hide the mining.","key_machinery":"The input is a dynamic data-flow graph built from WebAssembly execution traces; PoT records only data flowing into the three instructions and, shr, and xor, on the prior finding that these dominate proof-of-work hashing. Two mechanisms carry the argument. First, approximate graph simplification: because mining loops repeat the same hashing computation, the graph contains many isomorphic maximal rooted subgraphs at the same depth; Theorem 5 shows that the probability a vertex is visited in a backward random walk is determined entirely by its maximal rooted subgraph, so merging vertices with similar visit probabilities approximates exact merging and shrinks typical graphs by 93–99 percent. Second, the n-fragment inclusion score (n-FIS): for a known miner fingerprint H and a sample graph G, the score is the probability that a uniformly random connected subgraph of H with exactly $n$ edges is also a subgraph of G. PoT uses $n = 5$ and $k = 500$ randomly sampled fragments, tested with an approximate subgraph matcher, and flags a sample as malicious if any miner fingerprint scores at least 0.65.","core_discovery":"PoT's central claim is that the data-flow structure of a proof-of-work computation is a stable behavioral signature of cryptomining that survives standard obfuscation. The paper builds dynamic data-flow graphs from WebAssembly traces, recording for each execution of and, shr, and xor where its operands came from, so that repeated hashing iterations appear as repeated isomorphic subgraphs. To keep the graphs tractable, PoT merges isomorphic maximal rooted subgraphs at the same depth, using a backward-random-walk approximation validated by Theorem 5; typical graphs drop from over a thousand vertices to fewer than thirty. To decide whether a sample is malicious, PoT compares its simplified graph against a database of known miner fingerprints with the n-fragment inclusion score at $n = 5$, counting how often small connected fragments of the miner's fingerprint appear in the sample. On a benchmark of six open-source miners, thirty obfuscated variants, and twenty-nine real-world WebAssembly applications, PoT detects all six original miners and twenty-nine of thirty obfuscated variants while flagging no benign application, achieving the reported 98.3 percent accuracy and 100 percent specificity at the 0.65 threshold; the authors attribute this resilience to local fragment-based comparison rather than any global graph distance.","pith_inferences":["The paper does not test whether an obfuscator could eliminate the three instrumented opcodes entirely; a natural extension is to generate miner variants that implement the same bit operations via arithmetic or table lookups and check whether the 0.65 threshold still fires. If such variants evade detection, the practical fix would be to broaden the instrumented instruction set.","Because the simplification merges away the frequency of repeated substructures, the method should be insensitive to miners that pad their hash loops with extra iterations; conversely, a miner whose obfuscation fragments its computation into many non-isomorphic shapes could defeat the fingerprint, and that direction is untested.","The paper recommends per-fingerprint thresholds because the xmr fingerprint's small, simple graph produces high inclusion scores in several benign applications; a deployment would need score normalization, for example dividing by graph size, before the 100 percent specificity claim carries over to larger and more diverse benign workloads.","The same data-flow fingerprint idea could be applied to native binaries through dynamic binary instrumentation to cover server-side cryptomining; the paper claims generic applicability but demonstrates it only in WebAssembly, so the transfer remains a conjecture."],"forward_implications":["Obfuscations that defeat binary-image and instruction-count detectors — arithmetic encoding, control-flow flattening, bogus control flow, basic-block splitting, and instruction substitution — leave the data-flow fingerprint recognizable, so PoT catches 29 of 30 obfuscated miner samples at the 0.65 threshold.","Graph simplification makes the approach practical: data-flow graphs of over a thousand vertices shrink to a few dozen, cutting the time needed for fingerprint comparison.","Because the fingerprint records the structure of the computation rather than WebAssembly syntax, the same pipeline transfers to other execution platforms such as servers and data centers where cryptojacking also occurs.","The pairwise n-FIS scores separate distinct mining algorithms — CryptoNight variants share high mutual scores while Bitcoin, Ethereum, and yescrypt miners remain distinct — so the fingerprint carries algorithm identity, not just a miner/non-miner label.","New mining algorithms need only be fingerprinted once, and the paper notes that cryptomining scripts and algorithms are low in diversity, keeping the fingerprint database small."],"supporting_citations":[{"why":"It supplies the finding that the instructions and, shr, and xor are characteristic of cryptomining behavior, which motivates instrumenting only these three opcodes.","marker":"[72]"},{"why":"It provides the dynamic analysis tool used to instrument WebAssembly execution and collect the data-flow traces that form the fingerprints.","marker":"[44]"},{"why":"It provides the approximate subgraph matching used to test whether a sampled n-edge fragment of a miner fingerprint appears inside a sample graph.","marker":"[11]"},{"why":"It supplies the set of real-world non-miner WebAssembly applications used as benign benchmarks, as well as a forked instrumentation toolchain that improves compatibility.","marker":"[5]"},{"why":"It is the binary-image CNN baseline whose obfuscation vulnerability is demonstrated, and which PoT outperforms in the evaluation.","marker":"[55]"},{"why":"It is the static instruction-count heuristic baseline; in this evaluation it detects almost all miners but only 3.4 percent of benign samples.","marker":"[43]"},{"why":"It is the binary-metadata machine-learning baseline; its classifiers achieve high specificity but miss most obfuscated miners.","marker":"[62]"},{"why":"It demonstrates that WebAssembly binary diversification evades MINOS-style detectors and supplies the reimplemented MINOS baseline used in the experiments.","marker":"[12]"},{"why":"It documents how standard obfuscation evades existing cryptominer detectors and provides the LLVM-based obfuscation passes used to generate test samples.","marker":"[30]"},{"why":"It is the source-to-source obfuscator used to produce the arithmetic-encoding and function-split-and-flatten variants of the miners.","marker":"[20]"}],"fun_headline_variants":["Data-flow graphs catch obfuscated crypto miners","Obfuscated miners can't hide from data-flow fingerprints","PoT detector uses data-flow to spot hidden cryptominers","Graph-based method foils cryptomining obfuscation","98.3% accuracy: data-flow graphs defeat obfuscated miners"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that all the signal comes from data flowing into only three instructions — and, shr, and xor — so any proof-of-work implementation or obfuscator that avoids or replaces these opcodes would be invisible to the fingerprint; the paper adopts this premise from an earlier study and does not re-test it on the obfuscated binaries.","fun_headline_variants_meta":{"raw":{"variants":["Data-flow graphs catch obfuscated crypto miners","Obfuscated miners can't hide from data-flow fingerprints","PoT detector uses data-flow to spot hidden cryptominers","Graph-based method foils cryptomining obfuscation","98.3% accuracy: data-flow graphs defeat obfuscated miners"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000343,"raw_usage":{"total_tokens":1972,"prompt_tokens":1119,"completion_tokens":853,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":735,"completion_tokens_details":{"reasoning_tokens":766}},"tokens_in":735,"tokens_out":853,"duration_ms":8746,"temperature":1.0,"reasoning_tokens":766,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T00:50:37.724476+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Rewrite one of the six miners so that its hash loop performs the same bit operations without ever using and, shr, or xor (for example, via arithmetic identities or lookup tables), run it through the full PoT pipeline, and check whether any n-FIS score stays above 0.65; if the score falls below the threshold, the fingerprint is evadable by construction and the claimed accuracy is specific to the tested opcode footprint.","supporting_citations":[{"cited_title":"https://webassembly.org/","cited_arxiv_id":null,"evidence_quote":"It supplies the finding that the instructions and, shr, and xor are characteristic of cryptomining behavior, which motivates instrumenting only these three opcodes."},{"cited_title":"Arcmatch: high-performance subgraph matching for labeled graphs by exploiting edge domains","cited_arxiv_id":null,"evidence_quote":"It provides the approximate subgraph matching used to test whether a sampled n-edge fragment of a miner fingerprint appears inside a sample graph."},{"cited_title":"Titzer, Sukyoung Ryu, and Michael Pradel","cited_arxiv_id":null,"evidence_quote":"It supplies the set of real-world non-miner WebAssembly applications used as benign benchmarks, as well as a forked instrumentation toolchain that improves compatibility."},{"cited_title":"Cunha Neto, Martin Andreoni Lopez, Natalia C","cited_arxiv_id":null,"evidence_quote":"It is the binary-image CNN baseline whose obfuscation vulnerability is demonstrated, and which PoT outperforms in the evaluation."},{"cited_title":"Detection of illicit cryptomining using network metadata","cited_arxiv_id":null,"evidence_quote":"It is the binary-metadata machine-learning baseline; its classifiers achieve high specificity but miss most obfuscated miners."},{"cited_title":"Cryptic Bytes: WebAssembly Obfuscation for Evading Cryptojacking Detection","cited_arxiv_id":"2403.15197","evidence_quote":"It documents how standard obfuscation evades existing cryptominer detectors and provides the LLVM-based obfuscation passes used to generate test samples."},{"cited_title":"H ome --- tigress.wtf","cited_arxiv_id":null,"evidence_quote":"It is the source-to-source obfuscator used to produce the arithmetic-encoding and function-split-and-flatten variants of the miners."}],"review_version":1}