Vision transformer framework for host based cryptojacking malware detection

The rising adoption of cryptocurrencies has been paralleled by the emergence of cryptojacking malware, malicious software that covertly hijacks computing resources for unauthorized cryptocurrency mining. This threat not only degrades system performance and incurs financial losses but also increasingly evades traditional intrusion detection systems (IDSs), which often suffer from limited accuracy, high false positive rates, and poor adaptability in real-time or resource-constrained environments. To overcome these limitations, this study proposes CryptoIDS-ViT, an advanced IDS framework that employs vision transformer architectures, namely ViT, MaxViT, and SwinViT, for robust host-based cryptojacking detection. The significance of this work lies in both the growing need for accurate cryptojacking mitigation and the introduction of a novel end-to-end detection framework that adapts transformer-based models to a security-critical domain. The novelty of the approach stems from its image-based malware representation pipeline, where executable binaries are systematically transformed into both color and grayscale images, and from the custom adaptation and comparative benchmarking of multiple pretrained transformer models for detecting cryptojacking attacks, an underexplored and emerging cybersecurity challenge. A two-stage process involving deep feature extraction and classification enables accurate detection with high generalizability. Extensive evaluation on a balanced dataset of 40,000 samples (20,000 cryptojacking, 20,000 benign) demonstrates superior performance: the SwinViT model achieves 99.35% accuracy on color images and 99.08% on grayscale, with a precision of 99.41%, recall of 99.27%, and F1-score of 99.34%. Compared to state-of-the-art CNN-based IDSs, CryptoIDS-ViT delivers a 3-4% improvement in detection metrics while preserving real-time inference efficiency. Additional contributions include: (i) a custom binary-to-image encoding strategy tailored to malware feature extraction, (ii) ViT attention heatmap visualizations that enhance interpretability and model transparency, (iii) an ablation study evaluating input modality effects (color vs. grayscale), and (iv) a runtime and memory complexity analysis supporting deployment feasibility in edge or enterprise systems. These results validate the proposed framework's capability to generalize across input types and deployment contexts, establishing ViT-based IDSs as a scalable, interpretable, and practical solution for detecting sophisticated cryptojacking malware in modern cybersecurity infrastructures. Unlike existing studies that apply ViTs to general malware classification, this work delivers a focused, thoroughly evaluated, and high-impact contribution to the detection of host-based cryptojacking threats.