You're right, but I meant for bitcoin mining specifically. it's incredibly resource intensive, so it's not something you have to check for all the time, just when something seems to be behaving this way suddenly (and spinning up lots of instances, etc). When there's an obvious huge resource spike, you can just check to see if it's bitcoin mining.
If they want to be neutral and not do introspection like this without permission, they can ask the user on sign-up if they want "Protection from mining processes" where sudden activity spikes will cause them to do introspection and shut down an instance if it seems to be bitcoin mining.
EDIT: plus, bitcoin mining is the same operation over, and over, and over, and over again. You don't have to "catch" it doing a particular operation. A brief sample taken at any time will show the VM doing the same exact thing. (tons of SHA hashes.)
I'm not an expert though so perhaps I'm missing something!
If they want to be neutral and not do introspection like this without permission, they can ask the user on sign-up if they want "Protection from mining processes" where sudden activity spikes will cause them to do introspection and shut down an instance if it seems to be bitcoin mining.
EDIT: plus, bitcoin mining is the same operation over, and over, and over, and over again. You don't have to "catch" it doing a particular operation. A brief sample taken at any time will show the VM doing the same exact thing. (tons of SHA hashes.)
I'm not an expert though so perhaps I'm missing something!