CNAME Cloaking-Based Tracking on the Web: Characterization, Detection, and Protection
CNAME Cloaking-Based Tracking on the Web: Characterization, Detection, and Protection
复制标题
Web 上基于 CNAME 伪装的跟踪：特征、检测和保护
DOI：
--
复制
发表时间：
2021
影响因子：
5.3
通讯作者：
K. Fukuda
中科院分区：
文献类型：
--
作者：
Ha Dao;J. Mazel;K. Fukuda
网络上的第三方跟踪已用于收集和关联用户的浏览行为。由于广告拦截和第三方跟踪保护的使用越来越多，跟踪提供商引入了一种称为 CNAME 伪装的新技术。它会误导 Web 浏览器，让其相信对所访问网站的子域的请求源自该特定网站，而该子域使用 CNAME 解析为与跟踪相关的第三方域。因此，该技术规避了第三方针对隐私的保护。本文的目标是描述、检测和保护最终用户免受基于 CNAME 伪装的跟踪。首先，我们通过爬取 Alexa 前 300,000 个网站的首页，并通过 CNAME 黑名单分析 CNAME 伪装的使用情况，来描述基于 CNAME 伪装的跟踪，包括使用该技术跟踪用户活动的网站和跟踪提供商。我们还指出，除了带有开发者版本 uBlock Origin 扩展的 Firefox 之外，浏览器和隐私保护扩展对于处理基于 CNAME 伪装的跟踪基本上无效。其次，我们提出了一种基于监督机器学习的方法来检测基于 CNAME 伪装的跟踪，而无需按需 DNS 查找。我们证明所提出的方法优于众所周知的跟踪过滤器列表。最后，为了避免基于 Chrome 的浏览器缺乏 DNS API，我们设计并实现了一个基于监督机器学习的浏览器扩展原型，用于检测和过滤 CNAME 伪装跟踪，称为 CNAMETracking Uncloaker。我们的评估表明，与 Chrome 浏览器上的普通设置相比，CNAMETracking Uncloaker 能够过滤掉基于 CNAME 伪装的跟踪请求，而不会降低性能。
Third-party tracking on the Web has been used for collecting and correlating user’s browsing behavior. Due to the increasing use of ad-blocking and third-party tracking protections, tracking providers introduced a new technique called CNAME cloaking. It misleads Web browsers into believing that a request for a subdomain of the visited website originates from this particular website, while this subdomain uses a CNAME to resolve to a tracking-related third-party domain. This technique thus circumvents the third-party targeting privacy protections. The goals of this paper are to characterize, detect, and protect the end-user against CNAME cloaking based tracking. Firstly, we characterize CNAME cloaking-based tracking by crawling top pages of the Alexa Top 300,000 sites and analyzing the usage of CNAME cloaking with CNAME blocklist, including websites and tracking providers using this technique to track users’ activities. We also point out that browsers and privacy protection extensions are largely ineffective to deal with CNAME cloaking-based tracking except for Firefox with a developer’s version of the uBlock Origin extension. Secondly, we propose a supervised machine learning-based approach to detect CNAME cloaking-based tracking without the on-demand DNS lookup. We show that the proposed approach outperforms well-known tracking filter lists. Finally, to circumvent the lack of DNS API in Chrome-based browsers, we design and implement a prototype of the supervised machine learning-based browser extension to detect and filter out CNAME cloaking tracking, called CNAMETracking Uncloaker. Our evaluation shows that CNAMETracking Uncloaker is able to filter out CNAME cloaking-based tracking requests without performance degradation when compared with the vanilla setting on the Chrome browser.