ML-CB

Canvas fingerprinting is a technique used to surreptitiously—no user consent needed!—track users across the web.

The technique takes advantage of how different computers will draw the same image (on the canvas) differently, depending on the computer’s software and hardware characteristics. We conducted a large-scale study analyzing canvas fingerprinting on approximately half a million websites listed on Alexa Top Sites. We then created a “smart” tracking blocker which leverages a machine learning classifier to distinguish between images drawn for fingerprinting (i.e., tracking) and images drawn for non-fingerprinting (i.e., non-tracking).

The full paper, appearing in the 21st Privacy Enhancing Technologies Symposium, is available at the link below. This website summarizes a few of our high-level findings.

1Findings

• Canvas-based fingerprinting is rising
  Using the canvas for fingerprinting (i.e., tracking) is rising, with websites ranked between 1K to 10K on the Alexa Top Sites rank list engaging in canvas fingerprinting at a rate of roughly 5% in 2014, 7% in 2016, and 11% in 2018 (the time of our original website scrape).

  

  Code cloning is the norm
  A large majority of the JavaScript programs used for canvas-based fingerprinting are “cloned” (i.e., copied) on the web.

  

  Classifiers work best on text
  Although we used bread-and-butter, image-based machine learning techniques to assess classification performance on canvas images, we found that these methods ossify easily, and that machine learning based on natural langauge works better to correctly classify programs over time.

2Dataset

• 
  
  

  The dataset we produced contains over 3,000 distinct canvas images related to over 150,000 websites which used the canvas at the time of our website scrape. For example, searching the dataset for images (i.e., Canvas-Image) and files (i.e., Origin-URLs) related to the website Lenscrafters (i.e., Initiator) would return the row reproduced above.
  
  For a rendered view of origin-URLs and canvas images drawn—of those we flagged as engaging in canvas fingerprinting—follow this link (page load time may exceed a few minutes). The full file, raw csv, may be downloaded here, and the full dataset is available (Postgres) here.
  

3Canvas in the Wild

• With our nearly half-a-million-website-scrape data, we were able to assess use of the canvas on the web as a whole. We learned that canvas images are: (1) not predominantly used for tracking (i.e., fingerprinting), though this trend is waning as the practice is becoming more and more common; (2) repetitive, and often shared across domains; and (3) used consistently across website popularity, but pooled, in terms of fingerprinting, around content related to news, businesses, and cooking (as the figure below shows).
  

  

4Machine Learning Models

• We trained three text-based machine learning models on our data: (1) a Support Vector Machine (SVM); (2) a Bag-of-Words (BoW) model; and (3) a BoW-like, embedding model which uses the pretrained GloVe embedding. All models performed well when testing in a test-train-split fashion, using data from our original, massive web-scrape. The BoW and Embedding models, however, outperformed the SVM when it came to testing on a new, up-to-date dataset with many unseen examples.
  
  Further, we hypothesized that using a text transformation tool like jsNice (JavaScript name and type predictions) would help with classification performance overall. We found that although the jsNice transformation provides a small performance boost, it makes the most sense when a website owner tries to hide the purpose of their code through obfuscation. In this instance, using jsNice leads to a more performant classifier.

  

5Code

• The source code we used to build our models is available here, with all information hosted in a central basecamp here.

6Reference

• @article {Reitinger_2021_mlcb, 
      title        = {ML-CB: Machine Learning Canvas Block}, 
      author       = {Nathan Reitinger and Michelle L. Mazurek}, 
      year         = {2021}, 
      journal      = {Proceedings on Privacy Enhancing Technologies}, 
      publisher    = {Sciendo} 
  }