Abstract
Fingerprinting has been widely adopted by first- and third-party websites for the purpose of online tracking. It collects properties of operating systems, browsers, and even the hardware, for generating unique identifiers for visitors on websites. However, fingerprinting has raised both privacy and security concerns. In this paper, we present a traffic-based fingerprinting detection framework, FPExcavator. By analyzing the difference on values carried in outgoing requests from different browsers and machines, FPExcavator detects possible identifiers, as the generated fingerprints, in request header and payload. We implemented FPExcavator with OpenStack, Java, and some command scripts, and evaluated it on 100 websites in a lab setting and 100 websites selected from real-world. FPExcavator achieved 100% detection accuracy rate on 100 testing websites and 99% detection accuracy rate on 100 real-world websites. Meanwhile, it identified 12 new online tracking domains that have not been reported by previous research work. The evaluation results demonstrate that FPExcavator is useful and effective.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Acar, G., Eubank, C., Englehardt, S., Juarez, M., Narayanan, A., Diaz, C.: The web never forgets: Persistent tracking mechanisms in the wild. In: Proceedings of the ACM SIGSAC Conference on Computer & Communications Security, pp. 674–689 (2014)
Acar, G., et al.: Fpdetective: dusting the web for fingerprinters. In: Proceedings of the ACM SIGSAC Conference on Computer & Communications Security, pp. 1129–1140 (2013)
Akkus, I.E., Chen, R., Hardt, M., Francis, P., Gehrke, J.: Non-tracking web analytics. In: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, pp. 687–698 (2012)
Cai, X., Zhang, X.C., Joshi, B., Johnson, R.: Touching from a distance: website fingerprinting attacks and defenses. In: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, pp. 605–616 (2012)
Cao, Y., Li, S., Wijmans, E.: (Cross-)Browser fingerprinting via OS and Hardware level features. In: Proceedings of the Annual Network and Distributed System Security Symposium (2017)
Cova, M., Kruegel, C., Vigna, G.: Detection and analysis of drive-by-download attacks and malicious javascript code. In: Proceedings of the International Conference on World Wide Web, pp. 281–290 (2010)
Englehardt, S., Narayanan, A.: Online tracking: a 1-million-site measurement and analysis. In: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401 (2016)
Fifield, D., Egelman, S.: Fingerprinting web users through font metrics. In: International Conference on Financial Cryptography and Data Security, pp. 107–124 (2015)
Laperdrix, P., Rudametkin, W., Baudry, B.: Beauty and the beast: diverting modern web browsers to build unique browser fingerprints. In: Proceedings of the IEEE Symposium on Security and Privacy, pp. 878–894 (2016)
Lerner, A., Simpson, A.K., Kohno, T., Roesner, F.: Internet jones and the raiders of the lost trackers: an archaeological study of web tracking from 1996 to 2016. In: Proceedings of the USENIX Security Symposium (2016)
Timothy, L.: Exposing the invisible web: an analysis of third-party http requests on 1 million websites. Int. J. Commun. 9(2015), 3544–3561 (2015)
Mayer, J.R., Mitchell, J.C.: Third-party web tracking: policy and technology. In: Proceedings of the IEEE Symposium on Security and Privacy, pp. 413–427 (2012)
Nikiforakis, N., Joosen, W., Livshits, B.: Privaricator: deceiving fingerprinters with little white lies. In: Proceedings of the International Conference on World Wide Web, pp. 820–830 (2015)
Nikiforakis, N., Kapravelos, A., Joosen, W., Kruegel, C., Piessens, F., Vigna, G.: Cookieless monster: exploring the ecosystem of web-based device fingerprinting. In: Proceedings of the IEEE Symposium on Security and Privacy, pp. 541–555 (2013)
Rader, E.: Awareness of behavioral tracking and information privacy concern in facebook and google. In: Proceedings of the Symposium on Usable Privacy and Security (2014)
Roesner, F., Kohno, T., Wetherall, D.: Detecting and defending against third-party tracking on the web. In: Proceedings of the USENIX Conference on Networked Systems Design and Implementation (2012)
Torres, C.F., Jonker, H., Mauw, S.: Fp-block: usable web privacy by controlling browser fingerprinting. In: Proceedings of the European Symposium on Research in Computer Security, pp. 3–19 (2015)
Vastel, A., Laperdrix, P., Rudametkin, W., Rouvoy, R.: Fp-scanner: the privacy implications of browser fingerprint inconsistencies. In: Proceedings of the USENIX Security Symposium, pp. 135–150 (2018)
Vastel, A., Laperdrix, P., Rudametkin, W., Rouvoy, R.: Fp-stalker: tracking browser fingerprint evolutions. In: Proceedings of the IEEE Symposium on Security and Privacy, pp. 1–14 (2018)
Browser market share data from March 2018 to March 2019. http://gs.statcounter.com/browser-market-share
Google Privacy & Terms. https://policies.google.com/privacy?hl=en#infocollect
OpenStack. https://www.openstack.org/
Princeton Web Census. https://webtransparency.cs.princeton.edu/webcensus/
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Zhao, R., Chow, E., Li, C. (2019). Traffic-Based Automatic Detection of Browser Fingerprinting. In: Chen, S., Choo, KK., Fu, X., Lou, W., Mohaisen, A. (eds) Security and Privacy in Communication Networks. SecureComm 2019. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 304. Springer, Cham. https://doi.org/10.1007/978-3-030-37228-6_18
Download citation
DOI: https://doi.org/10.1007/978-3-030-37228-6_18
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-37227-9
Online ISBN: 978-3-030-37228-6
eBook Packages: Computer ScienceComputer Science (R0)