Characterization and countermeasure of tracking mechanism on the web

广告和跟踪生态系统在过去10年中大幅增长，建立在标准和更先进的网络跟踪技术的基础上。我们确定了一种基于PII泄漏的跟踪机制，允许跟踪提供商通过跨站点、跨浏览器和跨设备跟踪来持久地识别用户。我们分析了基于PII泄漏的跟踪的存在，并进行了实验，证实了基于PII泄漏跟踪的跨站点、跨浏览器和跨设备的在线行为广告。初步结果已提交给IEEE/ACM TNET 202。此外，我们还提出了PrivateLOGIN，使我们能够通过单点登录帐户执行大规模的网站登录自动化，并在此背景下分析隐私泄露。初步结果在2022年ACM AINTEC海报中公布，并已提交给IEEE/IFIP TMA 2023。此外，大学在注册时和与个人的互动中收集和处理大量的个人身份信息(PII)。然而，学生PII可能会在未经同意和知情的情况下通过上传文件以及大学通知向公众曝光，这可能会使个人面临各种不同的骗局，如身份盗窃、欺诈或网络钓鱼。我们对越南大学学生PII泄密事件进行了深入分析。初步结果已提交给IEICE信息与系统会刊2023。

The advertisement and tracking ecosystem has substantially grown in the last 10 years, building on standard and more advanced web tracking technologies. We identified a tracking mechanism based on PII leakage that allows tracking providers to persistently identify users through cross-site, cross-browser, and cross-device tracking. We analyzed the presence of PII leakage-based tracking and performed an experiment and confirm the Online Behavior Advertising occurring across multiple sites, browsers, and devices based-on PII leakage-based tracking. The preliminary results have been submitted to the IEEE/ACM TNET 2022.Also, we proposed PrivateLOGIN, which enables us to perform a large-scale automation of website login through an Single Sign-On account and analyze privacy leakage in this context. The preliminary results were presented in the ACM AINTEC poster 2022 and have been submitted to the IEEE/IFIP TMA 2023.In addition, universities collect and process a massive amount of Personal Identifiable Information (PII) at registration and throughout interactions with individuals. However, student PII can be exposed to the public by uploading documents along with university notice without consent and awareness, which could put individuals at risk of a variety of different scams, such as identity theft, fraud, or phishing. We performed an in-depth analysis of student PII leakage at Vietnamese universities. The preliminary results have been submitted to the IEICE Transactions on Information and Systems 2023.