Cryptojacking attacks in cloud Docker environments exploit computational resources for unauthorized cryptocurrency mining, degrading performance and increasing operational costs. Existing detection methods suffer from performance overhead, the inability to detect obfuscated activities, or the detection of runtime attacks. We present a lightweight Deep Learning (DL) framework analyzing resource utilization patterns for cryptojacking detection in controlled experimental environments. Our methodology employs temporal feature extraction from cloud Virtual Machine (VM) metrics (i.e., CPU, memory, disk I/O, and network utilization) and evaluates four popular DL architectures against direct mining and obfuscated scenarios. Systematic evaluation across Bitcoin, Ethereum, Shiba Inu, and Monero demonstrates that four architectures achieve 1.0 accuracy in our experimental setup. The optimal CNN architecture utilizes 4,548 parameters, maintains > 0.97 precision in obfuscated scenarios, and achieves < 0.001% false positive rates. The framework enables efficient cryptojacking detection in containerized environments with minimal computational overhead while maintaining robust security capabilities under controlled evaluation conditions.
QC 20260810