论文标题
FPSelect：低成本浏览器指纹用于缓解针对Web身份验证机制的字典攻击
FPSelect: Low-Cost Browser Fingerprints for Mitigating Dictionary Attacks against Web Authentication Mechanisms
论文作者
论文摘要
浏览器指纹构成从Web浏览器收集属性。多年来，已经发现了数百个属性。他们每个人都提供了一种区分浏览器的方法，但还带有可用性成本（例如，额外的收集时间）。在这项工作中，我们提出了FPSelect，这是一个属性选择框架，允许验证器调整其浏览器指纹探针以进行Web身份验证。我们将问题形式化为搜索满足安全要求并最小化可用性成本的属性集。确保被衡量为指纹探测器，用户群体以及知道用户群体中确切的指纹分布的攻击者的模仿用户的比例。可用性是通过浏览器指纹，其大小和不稳定性的收集时间来量化的。我们根据现实指纹数据集将我们的框架与常见基线进行比较，并发现在我们的实验设置中，我们的框架选择了较低的可用性成本属性集。与基线相比，FPSelect发现的属性集生成的指纹较小97倍，收集的速度高达3,361倍，并且平均在两个观测值之间变化的属性降低了7.2倍。
Browser fingerprinting consists into collecting attributes from a web browser. Hundreds of attributes have been discovered through the years. Each one of them provides a way to distinguish browsers, but also comes with a usability cost (e.g., additional collection time). In this work, we propose FPSelect, an attribute selection framework allowing verifiers to tune their browser fingerprinting probes for web authentication. We formalize the problem as searching for the attribute set that satisfies a security requirement and minimizes the usability cost. The security is measured as the proportion of impersonated users given a fingerprinting probe, a user population, and an attacker that knows the exact fingerprint distribution among the user population. The usability is quantified by the collection time of browser fingerprints, their size, and their instability. We compare our framework with common baselines, based on a real-life fingerprint dataset, and find out that in our experimental settings, our framework selects attribute sets of lower usability cost. Compared to the baselines, the attribute sets found by FPSelect generate fingerprints that are up to 97 times smaller, are collected up to 3,361 times faster, and with up to 7.2 times less changing attributes between two observations, on average.
