Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors
Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors
复制标题
DOI：
10.1109/sp40001.2021.00017
复制
发表时间：
2020-08
期刊：
影响因子：
--
通讯作者：
Umar Iqbal;Steven Englehardt;Zubair Shafiq
中科院分区：
文献类型：
--
作者：
Umar Iqbal;Steven Englehardt;Zubair Shafiq
浏览器指纹识别是一种侵入性和不透明的无状态跟踪技术。浏览器供应商、学术界和标准机构长期以来一直在努力提供有意义的保护，以防止浏览器指纹识别，既准确又不会降低用户体验。我们提出了FP-Inspector，一种基于机器学习的语法语义方法来准确检测浏览器指纹。我们表明，FP-Inspector表现良好，使我们能够检测到比最先进的指纹脚本多26%。我们表明，基于FP-Inspector的API级指纹对策有助于将网站破坏率降低2倍。我们使用FP-Inspector对前10万个网站的浏览器指纹进行了测量研究。我们发现，浏览器指纹现在存在于超过10%的前100 K网站和超过四分之一的前10 K网站。我们还通过指纹识别脚本发现了以前未报告的JavaScript API的使用，这表明他们正在寻找以新的和意想不到的方式利用API。
Browser fingerprinting is an invasive and opaque stateless tracking technique. Browser vendors, academics, and standards bodies have long struggled to provide meaningful protections against browser fingerprinting that are both accurate and do not degrade user experience. We propose FP-Inspector, a machine learning based syntactic-semantic approach to accurately detect browser fingerprinting. We show that FP-Inspector performs well, allowing us to detect 26% more fingerprinting scripts than the state-of-the-art. We show that an API-level fingerprinting countermeasure, built upon FP-Inspector, helps reduce website breakage by a factor of 2. We use FP-Inspector to perform a measurement study of browser fingerprinting on top-100K websites. We find that browser fingerprinting is now present on more than 10% of the top-100K websites and over a quarter of the top-10K websites. We also discover previously unreported uses of JavaScript APIs by fingerprinting scripts suggesting that they are looking to exploit APIs in new and unexpected ways.