FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting

TL;DR

FP-Fed introduces a distributed, privacy-preserving system enabling users to collaboratively detect browser fingerprinting through on-device federated learning, avoiding centralized data collection and resource-intensive analysis.

Contribution

It is the first system to apply federated learning with differential privacy for browser fingerprinting detection, enabling on-device, collaborative detection without sharing raw data.

Findings

Achieves high detection performance on real browsing data

Operates efficiently on-device without resource-intensive operations

Demonstrates effectiveness across various privacy levels and website types

Abstract

Browser fingerprinting often provides an attractive alternative to third-party cookies for tracking users across the web. In fact, the increasing restrictions on third-party cookies placed by common web browsers and recent regulations like the GDPR may accelerate the transition. To counter browser fingerprinting, previous work proposed several techniques to detect its prevalence and severity. However, these rely on 1) centralized web crawls and/or 2) computationally intensive operations to extract and process signals (e.g., information-flow and static analysis). To address these limitations, we present FP-Fed, the first distributed system for browser fingerprinting detection. Using FP-Fed, users can collaboratively train on-device models based on their real browsing patterns, without sharing their training data with a central entity, by relying on Differentially Private Federated Learning (DP-FL). To demonstrate its feasibility and effectiveness, we evaluate FP-Fed's performance on a set of 18.3k popular websites with different privacy levels, numbers of participants, and features extracted from the scripts. Our experiments show that FP-Fed achieves reasonably high detection performance and can perform both training and inference efficiently, on-device, by only relying on runtime signals extracted from the execution trace, without requiring any resource-intensive operation.