Cryptojacking detection using model-agnostic explainability

Abstract

Cryptojacking is the illicit use of computing resources for cryptocurrency mining. It has emerged as a serious cybersecurity threat that degrades critical system performance and increases operational costs. This paper proposes an advanced machine learning (ML) framework that integrates transformer based language models with post hoc explainable artificial intelligence (XAI) to detect cryptojacking using complementary network traffic and process memory data. Numerical and categorical features are discretized and tokenized to enable semantic modelling and contextual learning. Experimental results show that transformer models effectively capture cryptojacking-related behavioral patterns, with decoding-enhanced BERT with disentangled attention (DeBERTa) achieving high detection performance and recall exceeding 80%. bidirectional encoder representations from transformers (BERT) attains comparable recall with lower computational overhead, making it well suited for real-time environments, while robustly optimized BERT approach (RoBERTa) and DeBERTa are more appropriate for offline or batch-based analysis. Model performance is evaluated using standard classification metrics, and XAI techniques provide interpretable insights into feature relevance, supporting transparent and reliable detection. In general, the proposed framework delivers an effective and deployment-ready solution for cryptojacking detection.