Unveiling Web Fingerprinting in the Wild Via Code Mining and Machine Learning
Unveiling Web Fingerprinting in the Wild Via Code Mining and Machine Learning
复制标题
通过代码挖掘和机器学习揭开野外网络指纹的面纱
DOI：
--
复制
发表时间：
2020
影响因子：
--
通讯作者：
M. Mellia
中科院分区：
文献类型：
--
作者：
V. Rizzo;S. Traverso;M. Mellia
摘要近年来，由于广告公司需要准确跟踪用户及其在线习惯，网络指纹识别的实践不断发展，严重影响了用户的隐私。在本文中，我们设计，工程师和评估的方法，结合分析的JavaScript代码和机器学习的自动检测网络指纹。我们将我们的方法应用于一个数据集上，该数据集由大约1，000名志愿者在一个为期一个月的实验中访问的超过400，000个JavaScript文件组成，以观察指纹识别在真实的场景中的应用。我们比较了基于静态和动态代码分析的方法来自动检测指纹，并显示它们提供了不同的角度相互补充。这表明，基于静态或动态代码分析的研究提供了Web中实际指纹使用的部分视图。据我们所知，我们是第一个进行这种比较方面的指纹。我们的方法在很短的决策时间内达到了94%的准确率。有了这个，我们发现了840多个指纹服务，其中695个是流行的跟踪拦截器所不知道的。这些包括新的实际跟踪器以及将指纹用于跟踪以外的目的的服务，例如反欺诈和机器人识别。
Abstract Fueled by advertising companies’ need of accurately tracking users and their online habits, web fingerprinting practice has grown in recent years, with severe implications for users’ privacy. In this paper, we design, engineer and evaluate a methodology which combines the analysis of JavaScript code and machine learning for the automatic detection of web fingerprinters. We apply our methodology on a dataset of more than 400, 000 JavaScript files accessed by about 1, 000 volunteers during a one-month long experiment to observe adoption of fingerprinting in a real scenario. We compare approaches based on both static and dynamic code analysis to automatically detect fingerprinters and show they provide different angles complementing each other. This demonstrates that studies based on either static or dynamic code analysis provide partial view on actual fingerprinting usage in the web. To the best of our knowledge we are the first to perform this comparison with respect to fingerprinting. Our approach achieves 94% accuracy in small decision time. With this we spot more than 840 fingerprinting services, of which 695 are unknown to popular tracker blockers. These include new actual trackers as well as services which use fingerprinting for purposes other than tracking, such as anti-fraud and bot recognition.