CAREER: Tracking on the Modern Web: Novel Attacks, Measurements, and Defenses

职业：现代网络跟踪：新颖的攻击、测量和防御

• 批准号: 2143363
• 负责人: Jason Polakis
• 金额: $ 50万
• 依托单位: University of Illinois at Chicago
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-10-01 至 2027-09-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2143363&HistoricalAwards=false
• 关键词: CAREER; Tracking; Modern; Web; Novel

The web has become integral to everyday life, revolutionizing how personal and professional activities are conducted. At the heart of the web ecosystem lie browsers, which have evolved into complex application platforms with an ever-expanding set of capabilities. However, the deployment of new features also introduces new avenues for invading users’ privacy. This project focuses on enhancing the privacy protections available to users during their online activities, by developing robust defenses and privacy-preserving mechanisms. The underlying research necessitates designing and developing novel techniques and systems for analyzing browsers’ capabilities, uncovering how they can be misused for tracking or re-identifying users across first and third party contexts, and detecting attacks in the wild. This includes implementing static and dynamic analysis systems for orchestrating web browsers and applications, and developing browser-agnostic techniques and modular frameworks that advance the state-of-the-art in browser-feature and application-feature auditing and testing.This project will investigate, evaluate, and tackle the privacy threats affecting browsers through an in-depth and comprehensive analysis of a wide range of browser features and functionalities. This will enable the forecasting and prevention of privacy-invasive attacks, resulting in tangible benefits for end users, as well as the private and government sector. The main research problems that this project studies will form the basis for the training of both undergraduate and graduate students. The outcomes of this research will improve the research community's understanding of user tracking and privacy invasion on the web, and will be widely disseminated through academic publications, curriculum integration, and media articles.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

网络已经成为日常生活中不可或缺的一部分，彻底改变了个人和专业活动的进行方式。浏览器是网络生态系统的核心，它已经发展成为具有不断扩展的功能的复杂应用程序平台。然而，新功能的部署也为侵犯用户隐私引入了新的途径。该项目的重点是通过开发强大的防御和隐私保护机制，增强用户在在线活动中的隐私保护。基础研究需要设计和开发新的技术和系统来分析浏览器的功能，揭示它们如何被滥用来跟踪或重新识别第一和第三方上下文中的用户，并检测野外攻击。这包括实现静态和动态分析系统，用于编排Web浏览器和应用程序，并开发浏览器不可知技术和模块化框架，以推进浏览器功能和应用程序功能审计和测试的最新技术。该项目将通过深入和全面分析广泛的浏览器功能和功能，调查，评估和解决影响浏览器的隐私威胁。这将有助于预测和预防侵犯隐私的攻击，从而为最终用户以及私营和政府部门带来实实在在的好处。该项目研究的主要研究问题将成为本科生和研究生培养的基础。这项研究的成果将提高研究界对网络上用户跟踪和隐私侵犯的理解，并将通过学术出版物、课程整合和媒体文章广泛传播。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

ReScan: A Middleware Framework for Realistic and Robust Black-box Web Application Scanning

• DOI: 10.14722/ndss.2023.24169
• 发表时间: 2023
• 期刊: Proceedings 2023 Network and Distributed System Security Symposium
• 作者: Kostas Drakonakis;S. Ioannidis;Jason Polakis

Fashion Faux Pas: Implicit Stylistic Fingerprints for Bypassing Browsers' Anti-Fingerprinting Defenses

时尚失礼：绕过浏览器反指纹防御的隐式风格指纹

• DOI: 10.1109/sp46215.2023.10179437
• 发表时间: 2023
• 期刊: 2023 IEEE Symposium on Security and Privacy (SP)
• 作者: Xu Lin;F. Araujo;Teryl Taylor;Jiyong Jang;Jason Polakis
• 通讯作者: Jason Polakis

Escaping the Confines of Time: Continuous Browser Extension Fingerprinting Through Ephemeral Modifications

逃离时间的限制：通过短暂修改进行连续浏览器扩展指纹识别

• DOI: 10.1145/3548606.3560576
• 发表时间: 2022
• 期刊: ACM SIGSAC Conference on Computer and Communications Security (CCS
• 作者: Solomos, Konstantinos;Ilia, Panagiotis;Nikiforakis, Nick;Polakis, Jason
• 通讯作者: Polakis, Jason

Exploring the security and privacy risks of chatbots in messaging services

探索消息服务中聊天机器人的安全和隐私风险

• DOI: 10.1145/3517745.3561433
• 发表时间: 2022
• 期刊: ACM Internet Measurement Conference (IMC
• 作者: Edu, Jide;Mulligan, Cliona;Pierazzi, Fabio;Polakis, Jason;Suarez-Tangil, Guillermo;Such, Jose
• 通讯作者: Such, Jose

Navigating Murky Waters: Automated Browser Feature Testing for Uncovering Tracking Vectors

航行浑水：用于发现跟踪向量的自动浏览器功能测试

• DOI: 10.14722/ndss.2023.24072
• 发表时间: 2023
• 期刊: Network and Distributed System Security (NDSS
• 作者: Ali, Mir Masood;Chitale, Binoy;Ghasemisharif, Mohammad;Kanich, Chris;Nikiforakis, Nick;Polakis, Jason
• 通讯作者: Polakis, Jason