[Paper Review] Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors

Umar Iqbal, Steven Englehardt+1 more|arXiv (Cornell University)|Aug 10, 2020

Hate Speech and Cyberbullying Detection4 citations

TL;DR

FP-Inspector is a machine learning-based system that detects browser fingerprinting by combining static and dynamic analysis of JavaScript scripts, achieving 99.9% accuracy and detecting 26% more fingerprinting scripts than prior heuristics. It enables targeted API-level countermeasures that reduce website breakage by a factor of two, while uncovering widespread fingerprinting on 10.18% of the top-100K websites and previously unknown use of APIs like Permissions and Performance.

ABSTRACT

Browser fingerprinting is an invasive and opaque stateless tracking technique. Browser vendors, academics, and standards bodies have long struggled to provide meaningful protections against browser fingerprinting that are both accurate and do not degrade user experience. We propose FP-Inspector, a machine learning based syntactic-semantic approach to accurately detect browser fingerprinting. We show that FP-Inspector performs well, allowing us to detect 26% more fingerprinting scripts than the state-of-the-art. We show that an API-level fingerprinting countermeasure, built upon FP-Inspector, helps reduce website breakage by a factor of 2. We use FP-Inspector to perform a measurement study of browser fingerprinting on top-100K websites. We find that browser fingerprinting is now present on more than 10% of the top-100K websites and over a quarter of the top-10K websites. We also discover previously unreported uses of JavaScript APIs by fingerprinting scripts suggesting that they are looking to exploit APIs in new and unexpected ways.

Motivation & Objective

• To address the growing threat of invasive, opaque browser fingerprinting that evades traditional tracking protections.
• To overcome the limitations of existing countermeasures—such as blanket API restrictions or network request blocking—that cause website breakage.
• To develop a precise, scalable detection mechanism that distinguishes fingerprinting scripts from benign functionality without degrading user experience.
• To measure the real-world prevalence and evolving techniques of browser fingerprinting across the web.
• To identify previously unknown JavaScript APIs being exploited for fingerprinting to inform future privacy protections.

Proposed method

• FP-Inspector uses a hybrid approach combining static analysis (to overcome dynamic analysis coverage limits) and dynamic analysis (to handle obfuscation).
• It extracts syntactic and semantic features from JavaScript code, including control flow, data flow, and API call patterns, to train machine learning classifiers.
• The system leverages both client-side instrumentation and static code parsing to detect fingerprinting behavior at the script level.
• It applies targeted API restriction countermeasures based on detection results, minimizing breakage by avoiding broad restrictions.
• The framework is deployed on the Alexa top-100K websites using a modified OpenWPM pipeline to measure fingerprinting prevalence.
• It performs clustering analysis on JavaScript APIs used by fingerprinting scripts to identify novel fingerprinting vectors.

Experimental results

Research questions

• RQ1 How effective is a machine learning-based, syntactic-semantic approach in detecting browser fingerprinting scripts compared to manually designed heuristics?
• RQ2 To what extent can targeted API-level countermeasures reduce website breakage while still mitigating fingerprinting?
• RQ3 What is the current prevalence of browser fingerprinting across the top-100K websites, and which domains are responsible?
• RQ4 Which previously unknown or underappreciated JavaScript APIs are being exploited for fingerprinting?
• RQ5 How do adversarial techniques like script dispersion or amalgamation affect detection and mitigation?

Key findings

• FP-Inspector detects fingerprinting scripts with 99.9% accuracy, significantly outperforming prior heuristic-based detection methods.
• It detects 26% more fingerprinting scripts than the state-of-the-art heuristic-based approach from Englehardt and Narayanan (2018).
• Targeted API restriction countermeasures based on FP-Inspector reduce website breakage by a factor of two on sites prone to breakage.
• Browser fingerprinting is present on 10.18% of the Alexa top-100K websites, served by 2,349 distinct domains, including anti-ad fraud vendors and cross-site trackers.
• FP-Inspector uncovers previously unknown use of the Permissions and Performance APIs for fingerprinting, as well as novel usage of sensors like userproximity.
• The system identifies that fingerprinting scripts disproportionately leverage specific, previously under-recognized APIs, suggesting new attack vectors for future hardening.