Traffic-based automatic detection of browser fingerprinting

Rui Zhao; Edward Chow; Chunchun Li

doi:10.1007/978-3-030-37228-6_18

Traffic-based automatic detection of browser fingerprinting

Rui Zhao, Edward Chow, Chunchun Li

School of Interdisciplinary Informatics

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Fingerprinting has been widely adopted by first- and third-party websites for the purpose of online tracking. It collects properties of operating systems, browsers, and even the hardware, for generating unique identifiers for visitors on websites. However, fingerprinting has raised both privacy and security concerns. In this paper, we present a traffic-based fingerprinting detection framework, FPExcavator. By analyzing the difference on values carried in outgoing requests from different browsers and machines, FPExcavator detects possible identifiers, as the generated fingerprints, in request header and payload. We implemented FPExcavator with OpenStack, Java, and some command scripts, and evaluated it on 100 websites in a lab setting and 100 websites selected from real-world. FPExcavator achieved 100% detection accuracy rate on 100 testing websites and 99% detection accuracy rate on 100 real-world websites. Meanwhile, it identified 12 new online tracking domains that have not been reported by previous research work. The evaluation results demonstrate that FPExcavator is useful and effective.

Original language	English (US)
Title of host publication	Security and Privacy in Communication Networks - 15th EAI International Conference, SecureComm 2019, Proceedings
Editors	Songqing Chen, Kim-Kwang Raymond Choo, Xinwen Fu, Wenjing Lou, Aziz Mohaisen
Publisher	Springer
Pages	365-385
Number of pages	21
ISBN (Print)	9783030372279
DOIs	https://doi.org/10.1007/978-3-030-37228-6_18
State	Published - 2019
Event	15th International Conference on Security and Privacy in Communication Networks, SecureComm 2019 - Orlando , United States Duration: Oct 23 2019 → Oct 25 2019

Publication series

Name	Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST
Volume	304 LNICST
ISSN (Print)	1867-8211

Conference

Conference	15th International Conference on Security and Privacy in Communication Networks, SecureComm 2019
Country/Territory	United States
City	Orlando
Period	10/23/19 → 10/25/19

Keywords

Browser
Detection
Fingerprinting
Privacy

ASJC Scopus subject areas

Computer Networks and Communications

Access to Document

10.1007/978-3-030-37228-6_18

Cite this

Zhao, R., Chow, E., & Li, C. (2019). Traffic-based automatic detection of browser fingerprinting. In S. Chen, K-K. R. Choo, X. Fu, W. Lou, & A. Mohaisen (Eds.), Security and Privacy in Communication Networks - 15th EAI International Conference, SecureComm 2019, Proceedings (pp. 365-385). (Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST; Vol. 304 LNICST). Springer. https://doi.org/10.1007/978-3-030-37228-6_18

Traffic-based automatic detection of browser fingerprinting. / Zhao, Rui; Chow, Edward; Li, Chunchun.
Security and Privacy in Communication Networks - 15th EAI International Conference, SecureComm 2019, Proceedings. ed. / Songqing Chen; Kim-Kwang Raymond Choo; Xinwen Fu; Wenjing Lou; Aziz Mohaisen. Springer, 2019. p. 365-385 (Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST; Vol. 304 LNICST).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Zhao, R, Chow, E & Li, C 2019, Traffic-based automatic detection of browser fingerprinting. in S Chen, K-KR Choo, X Fu, W Lou & A Mohaisen (eds), Security and Privacy in Communication Networks - 15th EAI International Conference, SecureComm 2019, Proceedings. Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST, vol. 304 LNICST, Springer, pp. 365-385, 15th International Conference on Security and Privacy in Communication Networks, SecureComm 2019, Orlando , United States, 10/23/19. https://doi.org/10.1007/978-3-030-37228-6_18

Zhao R, Chow E, Li C. Traffic-based automatic detection of browser fingerprinting. In Chen S, Choo K-KR, Fu X, Lou W, Mohaisen A, editors, Security and Privacy in Communication Networks - 15th EAI International Conference, SecureComm 2019, Proceedings. Springer. 2019. p. 365-385. (Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST). doi: 10.1007/978-3-030-37228-6_18

Zhao, Rui ; Chow, Edward ; Li, Chunchun. / Traffic-based automatic detection of browser fingerprinting. Security and Privacy in Communication Networks - 15th EAI International Conference, SecureComm 2019, Proceedings. editor / Songqing Chen ; Kim-Kwang Raymond Choo ; Xinwen Fu ; Wenjing Lou ; Aziz Mohaisen. Springer, 2019. pp. 365-385 (Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST).

@inproceedings{6279c8a23a3448da9bff38d829d95879,

title = "Traffic-based automatic detection of browser fingerprinting",

abstract = "Fingerprinting has been widely adopted by first- and third-party websites for the purpose of online tracking. It collects properties of operating systems, browsers, and even the hardware, for generating unique identifiers for visitors on websites. However, fingerprinting has raised both privacy and security concerns. In this paper, we present a traffic-based fingerprinting detection framework, FPExcavator. By analyzing the difference on values carried in outgoing requests from different browsers and machines, FPExcavator detects possible identifiers, as the generated fingerprints, in request header and payload. We implemented FPExcavator with OpenStack, Java, and some command scripts, and evaluated it on 100 websites in a lab setting and 100 websites selected from real-world. FPExcavator achieved 100% detection accuracy rate on 100 testing websites and 99% detection accuracy rate on 100 real-world websites. Meanwhile, it identified 12 new online tracking domains that have not been reported by previous research work. The evaluation results demonstrate that FPExcavator is useful and effective.",

keywords = "Browser, Detection, Fingerprinting, Privacy",

author = "Rui Zhao and Edward Chow and Chunchun Li",

note = "Publisher Copyright: {\textcopyright} ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2019.; 15th International Conference on Security and Privacy in Communication Networks, SecureComm 2019 ; Conference date: 23-10-2019 Through 25-10-2019",

year = "2019",

doi = "10.1007/978-3-030-37228-6_18",

language = "English (US)",

isbn = "9783030372279",

series = "Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST",

publisher = "Springer",

pages = "365--385",

editor = "Songqing Chen and Choo, {Kim-Kwang Raymond} and Xinwen Fu and Wenjing Lou and Aziz Mohaisen",

booktitle = "Security and Privacy in Communication Networks - 15th EAI International Conference, SecureComm 2019, Proceedings",

}

TY - GEN

T1 - Traffic-based automatic detection of browser fingerprinting

AU - Zhao, Rui

AU - Chow, Edward

AU - Li, Chunchun

N1 - Publisher Copyright: © ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2019.

PY - 2019

Y1 - 2019

N2 - Fingerprinting has been widely adopted by first- and third-party websites for the purpose of online tracking. It collects properties of operating systems, browsers, and even the hardware, for generating unique identifiers for visitors on websites. However, fingerprinting has raised both privacy and security concerns. In this paper, we present a traffic-based fingerprinting detection framework, FPExcavator. By analyzing the difference on values carried in outgoing requests from different browsers and machines, FPExcavator detects possible identifiers, as the generated fingerprints, in request header and payload. We implemented FPExcavator with OpenStack, Java, and some command scripts, and evaluated it on 100 websites in a lab setting and 100 websites selected from real-world. FPExcavator achieved 100% detection accuracy rate on 100 testing websites and 99% detection accuracy rate on 100 real-world websites. Meanwhile, it identified 12 new online tracking domains that have not been reported by previous research work. The evaluation results demonstrate that FPExcavator is useful and effective.

AB - Fingerprinting has been widely adopted by first- and third-party websites for the purpose of online tracking. It collects properties of operating systems, browsers, and even the hardware, for generating unique identifiers for visitors on websites. However, fingerprinting has raised both privacy and security concerns. In this paper, we present a traffic-based fingerprinting detection framework, FPExcavator. By analyzing the difference on values carried in outgoing requests from different browsers and machines, FPExcavator detects possible identifiers, as the generated fingerprints, in request header and payload. We implemented FPExcavator with OpenStack, Java, and some command scripts, and evaluated it on 100 websites in a lab setting and 100 websites selected from real-world. FPExcavator achieved 100% detection accuracy rate on 100 testing websites and 99% detection accuracy rate on 100 real-world websites. Meanwhile, it identified 12 new online tracking domains that have not been reported by previous research work. The evaluation results demonstrate that FPExcavator is useful and effective.

KW - Browser

KW - Detection

KW - Fingerprinting

KW - Privacy

UR - http://www.scopus.com/inward/record.url?scp=85077510132&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85077510132&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-37228-6_18

DO - 10.1007/978-3-030-37228-6_18

M3 - Conference contribution

AN - SCOPUS:85077510132

SN - 9783030372279

T3 - Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST

SP - 365

EP - 385

BT - Security and Privacy in Communication Networks - 15th EAI International Conference, SecureComm 2019, Proceedings

A2 - Chen, Songqing

A2 - Choo, Kim-Kwang Raymond

A2 - Fu, Xinwen

A2 - Lou, Wenjing

A2 - Mohaisen, Aziz

PB - Springer

T2 - 15th International Conference on Security and Privacy in Communication Networks, SecureComm 2019

Y2 - 23 October 2019 through 25 October 2019

ER -

Traffic-based automatic detection of browser fingerprinting

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this