Date of Award

August 2026

Document Type

Thesis

Degree Name

Master of Science (MS)

Department

Computer Science

First Advisor

Prakash P. Ranganathan

Abstract

This thesis evaluates benign-only detection of covert CPU-based cryptomining on Linux ARMedge devices and the cross-host portability of the same detector in a retrospective simulated federated-learning bridge. The detector uses thirteen coarse host features comprising CPU-time fractions, temperature, load averages, process-state gauges, and available memory. Adversary stealth is escalated across an ordered ladder rather than fixed at a single overt setting. The single-device experiment shows a steep detection boundary on two configuration- identical Jetson Orin Nano devices. For obvious and throttled mining the primary autoencoder reaches the structural ceiling of the twelve-window sustained-alert gate: 0.9896 is what a satu- rated phase of roughly 1060 windows yields once the gate’s first eleven windows are excluded. Recall then degrades under duty-cycling to 0.1113/0.2104 and reaches floor level under reactive SIGSTOP/SIGCONT suppression at 0.0038/0.0670 — four sustained windows out of 1060 on the primary device. Held-out resident-memory falsification episodes produce zero sustained false alerts in 997 eligible windows per device. An Isolation Forest and a sequence autoencoder exhibit comparable hard-phase collapse under the same benign-only protocol. The federated bridge partitions the frozen archive by host and compares local, centralized, zero-shot, and federated-averaging regimes. No regime provides a uniform hard-phase rescue. Reusing a source threshold can fire on nearly every benign window on the target host, and cross- host ranking varies materially by direction, sitting near or below chance in several cells. Passive CPU-centric telemetry is therefore useful against low-stealth cryptomining and reaches a measured boundary at the suppression frontier.

Download

Available for download on Wednesday, September 08, 2027

Share

COinS