Collaborative Research: SaTC: CORE: Medium: Defending against Emerging Stateless Web Tracking

Web正在不断发展，以支持新功能并适应用户和Web应用程序不断变化的需求。与此同时，在线行为广告生态系统利用这些新兴功能对网络用户进行隐私侵犯跟踪。传统上，网络跟踪一直在滥用Cookie等浏览器功能，但新的高级网络跟踪技术(浏览器指纹识别)正在出现。浏览器指纹识别技术利用了浏览器配置中存在细微差异的用户，从而使他们能够被识别。该项目的创新之处在于推进网络跟踪的当前知识状态，以及我们如何防御它。该项目的更广泛的意义和重要性是通过改进针对网络跟踪的对策来增强数百万用户的隐私，这些对策可以部署在主流和注重隐私的网络浏览器中。该项目的主要目标是从根本上改变对无状态Web跟踪的检测和防御。与以前依赖手动或临时方法的工作不同，该项目采用了一种原则性的方法，利用浏览器工具来构建Web API使用的签名，Web API是浏览器指纹识别的构建块。该项目构建了机器学习技术，以改进无状态跟踪检测，并量化不同Web API的隐私风险。此外，最先进的反无状态跟踪方法在对抗性策略面前是无效和脆弱的，并且由于其粗粒度和不透明的性质而降低了用户体验。该项目使用细粒度技术缓解指纹行为，并推断Web API使用背后的意图，从而在正确的时间实施正确的缓解，以最大限度地减少对合法功能的破坏。该项目还使机器学习决策变得可解释，以更好地向用户和浏览器供应商通报网络上无状态跟踪的进展。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The web is continuously evolving to support new features and accommodate the constantly-changing demands of users and web applications. At the same time, the online behavioral advertising ecosystem exploits these emerging features for privacy-invasive tracking of web users. Traditionally, tracking on the web has been abusing browser features such as cookies, but new advanced web tracking techniques (browser fingerprinting) are emerging. Browser fingerprinting techniques capitalize on users having subtle differences in their browser configurations that make them identifiable. The project’s novelties are to advance the current state of knowledge of web tracking and how we can defend against it. The project's broader significance and importance are to enhance the privacy of millions of users by improving countermeasures against web tracking that can be deployed in mainstream and privacy-focused web browsers. The main goal of this project is to fundamentally change the detection and defense against stateless web tracking. Unlike prior work that relies on manual or ad-hoc approaches, this project takes a principled approach that leverages browser instrumentation to build signatures of usage of web APIs, the building blocks of browser fingerprinting. The project builds machine learning techniques to improve stateless tracking detection and to quantify the privacy risks of different web APIs. Furthermore, the state-of-the-art approaches to counter stateless tracking are ineffective and brittle in the face of adversarial tactics and also degrade user experience due to their coarse-grained and opaque nature. This project mitigates fingerprinting behavior with fine-grained techniques and infers the intent behind the usage of web APIs, thus enforcing the right mitigation at the right time to minimize the breakage of legitimate functionality. The project also makes the machine learning decisions explainable to better inform users and browser vendors of the progress of stateless tracking on the web.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.