Deanonimization of a web resource user using browser fingerprint formation technology

Sharmaev Vadim Igorevich, Karpukhin Evgeny Olegovich, Sidorin Sergey Yurievich, Zherdev Alexander Alexandrovich

There are many approaches to collecting information about a user on the network, which differ both in the means used and in the end goal. The most common deanonymization methods are easily bypassed by attackers - the site's cookie processing is disabled, the IP address is hidden, and only the incognito session is used. One of the most flexible approaches is the browser fingerprint technology discussed in the article, the essence of which is to generate a unique user identifier based on a set of user parameters (information about the operating system, browser version, selected system language, time zone, screen resolution, color depth, and also many others). The paper highlights the main characteristics of the user that can be used in the formation of a browser fingerprint, their features are disclosed. User deanonymization can be used to create customized advertising campaigns tailored to the interests of the person, to improve content recommendation systems (for example, articles, videos, music), for secure authentication, collecting statistics about site visitors and analytics. The article also provides other possible scenarios for applying the technology. The methodology presents three possible scenarios: cross-browser solution, maximum amount of data, and high accuracy. For each of the scenarios, the most appropriate array of user characteristics used to form the fingerprint was selected, and examples of the JavaScript script were demonstrated. The disadvantage of the technology is the fact that when the value of one of the analyzed parameters changes, the entire output data block also changes. The solution to this problem is the choice of the optimal sensitivity threshold. The calculation of the optimal sensitivity threshold depending on the number of analyzed parameters is made, examples of its use to determine whether to consider the user of the web service as a repeat visitor or a new user are given. Conclusions are drawn about the applicability of the technology in practice, recommendations are given to improve the accuracy of the result.

Keywords:browser fingerprint, device fingerprint, user deanonymization, JavaScript.