Collaborative Research: SaTC: CORE: Medium: Defending against Emerging Stateless Web Tracking

协作研究：SaTC：核心：中：防御新兴的无状态网络跟踪

• 批准号: 2138139
• 负责人: Zubair Shafiq
• 金额: $ 40万
• 依托单位: University of California-Davis
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-06-15 至 2026-05-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2138139&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Medium

The web is continuously evolving to support new features and accommodate the constantly-changing demands of users and web applications. At the same time, the online behavioral advertising ecosystem exploits these emerging features for privacy-invasive tracking of web users. Traditionally, tracking on the web has been abusing browser features such as cookies, but new advanced web tracking techniques (browser fingerprinting) are emerging. Browser fingerprinting techniques capitalize on users having subtle differences in their browser configurations that make them identifiable. The project’s novelties are to advance the current state of knowledge of web tracking and how we can defend against it. The project's broader significance and importance are to enhance the privacy of millions of users by improving countermeasures against web tracking that can be deployed in mainstream and privacy-focused web browsers. The main goal of this project is to fundamentally change the detection and defense against stateless web tracking. Unlike prior work that relies on manual or ad-hoc approaches, this project takes a principled approach that leverages browser instrumentation to build signatures of usage of web APIs, the building blocks of browser fingerprinting. The project builds machine learning techniques to improve stateless tracking detection and to quantify the privacy risks of different web APIs. Furthermore, the state-of-the-art approaches to counter stateless tracking are ineffective and brittle in the face of adversarial tactics and also degrade user experience due to their coarse-grained and opaque nature. This project mitigates fingerprinting behavior with fine-grained techniques and infers the intent behind the usage of web APIs, thus enforcing the right mitigation at the right time to minimize the breakage of legitimate functionality. The project also makes the machine learning decisions explainable to better inform users and browser vendors of the progress of stateless tracking on the web.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

Web在不断发展，以支持新的功能，并适应用户和Web应用程序不断变化的需求。与此同时，在线行为广告生态系统利用这些新兴功能对网络用户进行侵犯隐私的跟踪。传统上，网络上的跟踪一直在滥用浏览器功能，如cookie，但新的高级网络跟踪技术（浏览器指纹）正在出现。浏览器指纹识别技术利用了用户在浏览器配置中的细微差异，使他们能够识别。该项目的创新之处在于提高了对网络跟踪的认识，以及我们如何防范网络跟踪。该项目更广泛的意义和重要性在于，通过改进可以部署在主流和注重隐私的网络浏览器中的网络跟踪对策，增强数百万用户的隐私。该项目的主要目标是从根本上改变对无状态Web跟踪的检测和防御。与以前依赖于手动或临时方法的工作不同，该项目采用了一种原则性的方法，利用浏览器工具来构建Web API使用的签名，即浏览器指纹的构建块。该项目构建了机器学习技术，以改善无状态跟踪检测，并量化不同Web API的隐私风险。此外，对抗无状态跟踪的最先进方法在对抗策略面前是无效和脆弱的，并且由于其粗粒度和不透明的性质，也会降低用户体验。该项目使用细粒度技术减轻指纹识别行为，并推断Web API使用背后的意图，从而在正确的时间实施正确的缓解措施，以最大限度地减少对合法功能的破坏。该项目还使机器学习决策变得可解释，以更好地告知用户和浏览器供应商网络上无状态跟踪的进展。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

AutoFR: Automated Filter Rule Generation for Adblocking

• 发表时间: 2022-02
• 作者: Hieu Le;Salma Elmalaki;A. Markopoulou;Zubair Shafiq

Blocking JavaScript without Breaking the Web

在不破坏网络的情况下阻止 JavaScript

• 发表时间: 2023
• 期刊: Privacy Enhancing Technologies Symposium (PETS
• 作者: Abdul Haddi Amjad;Zubair Shafiq;Muhammad Ali Gulzar
• 通讯作者: Muhammad Ali Gulzar

CookieGraph: Understanding and Detecting First-Party Tracking Cookies

CookieGraph：理解和检测第一方跟踪 Cookie

• 发表时间: 2023
• 期刊: ACM Conference on Computer and Communications Security (CCS
• 作者: Shaoor Munir;Sandra Siby;Umar Iqbal;Steven Englehardt;Zubair Shafiq;Carmela Troncoso
• 通讯作者: Carmela Troncoso