FProbe: The Flow-Centric Detection and a Large-Scale Measurement of Browser Fingerprinting

Browser fingerprinting has been used by websites for advertising and analytics. It uses JavaScript objects and APIs to collect browser attributes and generate unique identifiers for tracking online users. A few research works have been proposed to detect browser fingerprinting. They focused on the browser's built-in JavaScript objects and APIs that are invoked to retrieve browser attribute values but ignored the use of browser attributes in scripts. In this paper, we define the behavior of browser fingerprinting as aggregating different types of browser attributes, and reduce browser fingerprinting detection to a joint analysis of data flows of browser attribute values in JavaScript code. We propose a flow-centric browser fingerprinting detection framework, FProbe, which performs context-sensitive static data flow analysis of JavaScript code. We implemented FProbe in Java and evaluated it using 4,296 fingerprinting scripts from the recent work and 2,335,317 pieces of JavaScript code from 988,220 websites. FProbe achieved 97.81% and 96.31% F-measure on them, respectively. It identified browser fingerprinting behavior on 0.78% of the 988,220 websites. Only 72 fingerprinting scripts and 10 fingerprinting providers identified by FProbe were reported in previous work. The results show that FProbe is effective in detecting browser fingerprinting and complementary to existing detection tools.