[freeall]

I would think that looking at patterns on the CPU level is almost impossible. The overhead would be enormous.

For instance if you look for a magic number. Instead of putting two numbers on the stack, and perform an addition you now have to have a conditional jump before the addition.

Maybe I'm wrong, but at least I think it would be virtually impossible.

[logicallee]

You're right, but I meant for bitcoin mining specifically. it's incredibly resource intensive, so it's not something you have to check for all the time, just when something seems to be behaving this way suddenly (and spinning up lots of instances, etc). When there's an obvious huge resource spike, you can just check to see if it's bitcoin mining.

If they want to be neutral and not do introspection like this without permission, they can ask the user on sign-up if they want "Protection from mining processes" where sudden activity spikes will cause them to do introspection and shut down an instance if it seems to be bitcoin mining.

EDIT: plus, bitcoin mining is the same operation over, and over, and over, and over again. You don't have to "catch" it doing a particular operation. A brief sample taken at any time will show the VM doing the same exact thing. (tons of SHA hashes.)

I'm not an expert though so perhaps I'm missing something!