A storage system, including a host device; and a storage device including a nonvolatile memory and at least one processor configured to implement a storage internal protection (SIP) module, wherein the SIP module is configured to: obtain, from the host device, a plurality of storage commands corresponding to the nonvolatile memory, filter the plurality of storage commands to obtain a filtered plurality of storage commands, apply information about the filtered plurality of storage commands to a machine-learning cryptocurrency mining (CM) detection algorithm, and based on the machine-learning CM detection algorithm indicating that a CM operation is detected, provide a notification to the host device.