Collaborative Research: SaTC: CORE: Medium: Defending against Emerging Stateless Web Tracking

North Carolina State University, Raleigh NC

Investigators

Abstract

The web is continuously evolving to support new features and accommodate the constantly-changing demands of users and web applications. At the same time, the online behavioral advertising ecosystem exploits these emerging features for privacy-invasive tracking of web users. Traditionally, tracking on the web has been abusing browser features such as cookies, but new advanced web tracking techniques (browser fingerprinting) are emerging. Browser fingerprinting techniques capitalize on users having subtle differences in their browser configurations that make them identifiable. The project’s novelties are to advance the current state of knowledge of web tracking and how we can defend against it. The project's broader significance and importance are to enhance the privacy of millions of users by improving countermeasures against web tracking that can be deployed in mainstream and privacy-focused web browsers. The main goal of this project is to fundamentally change the detection and defense against stateless web tracking. Unlike prior work that relies on manual or ad-hoc approaches, this project takes a principled approach that leverages browser instrumentation to build signatures of usage of web APIs, the building blocks of browser fingerprinting. The project builds machine learning techniques to improve stateless tracking detection and to quantify the privacy risks of different web APIs. Furthermore, the state-of-the-art approaches to counter stateless tracking are ineffective and brittle in the face of adversarial tactics and also degrade user experience due to their coarse-grained and opaque nature. This project mitigates fingerprinting behavior with fine-grained techniques and infers the intent behind the usage of web APIs, thus enforcing the right mitigation at the right time to minimize the breakage of legitimate functionality. The project also makes the machine learning decisions explainable to better inform users and browser vendors of the progress of stateless tracking on the web. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.