DrawnApart：一种深度学习增强的 GPU 指纹识别技术（NDSS） 原文标题：DrawnApart: A Deep-Learning Enhanced GPU Fingerprinting Technique - NDSS Symposium
内容概要总结
本文是 NDSS（网络与分布式系统安全研讨会）论文《DrawnApart: A Deep-Learning Enhanced GPU Fingerprinting Technique》的官方页面（作者 Naif Mehanna，University of Lille/CNRS/Inria；Tomer Laor，Ben-Gurion University of the Negev）。摘要指出：浏览器指纹识别用于识别用户或其设备；本文报告一种新技术，可显著延长基于指纹的追踪方法的追踪时长；通过大量实验表明，构成 GPU 的多个执行单元之间的速度差异可作为可靠且稳健的设备签名，并可用无特权 JavaScript 收集。演讲描述部分聚焦 DrawnApart 的实验过程：如何调整其内核以适配无特权 JavaScript 的约束、如何选择最佳参数（算术运算符与计时方法）、如何从实验室受控流水线转向现实开放世界流水线（放弃经典机器学习、采用深度学习方法）、如何实现并适配最先进的浏览器指纹追踪算法 FP-Stalker，以及在数月内通过 AmIUnique 平台收集的 2,500 多台不同设备上测试该流水线。页面另附两位作者的简介。
翻译内容
原文内容（English）
Naif Mehanna（University of Lille, CNRS, Inria）、Tomer Laor（Ben-Gurion University of the Negev）
浏览器指纹识别旨在通过执行在用户浏览器中、收集软件或硬件特征信息的脚本来识别用户或其设备。它被用于追踪用户，或作为提高安全性的一种附加识别手段。在本文中，我们报告了一种新技术，它可以显著延长基于指纹的追踪方法的追踪时长。通过大量实验，我们表明，构成 GPU 的多个执行单元之间的速度差异可以作为一种可靠且稳健的设备签名，并且可以用无特权的 JavaScript 收集。
在本次演讲中，我们聚焦于 DrawnApart 的实验方面，以及通向一个有效 GPU 指纹识别算法的各个步骤。特别是，我们讨论了 DrawnApart 的内核是如何被调整以适配无特权 JavaScript 所带来的约束的。我们呈现了一幅更宏观的图景，即为了选出能让我们的方法在大多数设置下高效区分设备的最佳参数所采取的步骤：更具体地说，我们讨论了关于所选算术运算符和不同计时方法的实验。我们还解释了如何从一个主要适合实验室受控场景的 GPU 指纹识别流水线，转变为一条在现实开放世界场景中也能工作的流水线——通过放弃经典机器学习技术、采用基于深度学习的方法。
我们讨论了如何实现最先进的浏览器指纹追踪算法 FP-Stalker，并使其适配当前 Web 的状况。最后，我们强调 DrawnApart 深度学习流水线被引入 FP-Stalker 的方式，并在数月期间通过我们的 AmIUnique 平台收集的 2,500 多台不同设备上进行了测试。
Naif Mehanna 于 2019 年从法国里尔大学理工学院（Polytechnique school of the University of Lille）电气工程专业毕业。2020 年 9 月，他在里尔大学攻读博士项目，导师为 Walter Rudametkin 博士。他最致力于朝着更安全、更私密的浏览体验努力。这些兴趣驱动着他的博士论文，该论文主要聚焦硬件浏览器指纹识别和网络追踪。
Tomer Laor 是 Ben Gurion University 的硕士生，师从 Yossi Oren 博士。他的主要研究兴趣是隐私，重点是利用机器学习进行 Web 上的硬件指纹识别。
查看更多论文
获取一个模型！针对机器学习的模型劫持攻击……
Ahmed Salem（CISPA Helmholtz Center for Information Security）、Michael Backes（CISPA Helmholtz Center for Information Security）、Yang Zhang（CISPA Helmholtz Center for Information Security）
ScriptChecker：用任务能力驯服第三方脚本执行
Wu Luo（Peking University）、Xuhua Ding（Singapore Management University）、Pengfei Wu（School of Computing, National University of Singapore）、Xiaolei Zhang（Peking University）、Qingni Shen（Peking University）、Zhonghai Wu（Peking University）
FANDEMIC：电源管理上的固件攻击构建与部署……
Ryan Tsang（University of California, Davis）、Doreen Joseph（University of California, Davis）、Qiushi Wu（University of California, Davis）、Soheil Salehi（University of California, Davis）、Nadir Carreon（University of Arizona）、Prasant Mohapatra（University of California, Davis）、Houman Homayoun（University of California, Davis）
Naif Mehanna (University of Lille, CNRS, Inria), Tomer Laor (Ben-Gurion University of the Negev)
Browser fingerprinting aims to identify users or their devices, through scripts that execute in the users' browser and collect information on software or hardware characteristics. It is used to track users or as an additional means of identification to improve security. In this paper, we report on a new technique that can significantly extend the tracking time of fingerprint-based tracking methods. Through extensive experimentation, we show that variations in speed among the multiple execution units that comprise a GPU can serve as a reliable and robust device signature, which can be collected using unprivileged JavaScript.
In this talk, we focus on the experimental aspect of DrawnApart and the different steps that led to an effective GPU fingerprinting algorithm. In particular, we discuss how the inner core of DrawnApart was adapted to fit the constraints posed by unprivileged Javascript. We present a broader picture of the steps taken to choose the best parameters that made our method able to distinguish devices efficiently in most settings: more specifically, we discuss our experiments on the chosen arithmetic operators and the different timing methods. We also explain how we moved from a GPU-fingerprinting pipeline that is mostly suited for a lab-controlled scenario to a pipeline that works in a realistic open world scenario by abandoning classical machine learning techniques and adopting a deep-learning based approach.
We discuss how we implemented the state-of-the-art browser fingerprint tracking algorithm - FP-Stalker - and adapted it to the current state of the web. Finally, we emphasize the way that the DrawnApart deep-learning pipeline was introduced into FP-Stalker and tested on over 2,500 distinct devices collected through our AmIUnique platform over the period of several months.
Naif Mehanna graduated in Electrical Engineering from the Polytechnique school of the University of Lille, France, in 2019. On September 2020, he enrolled in a PhD program at the University of Lille under the supervision of Dr. Walter Rudametkin. He is most motivated to work toward a safer and more private browsing experience. These interests are what drive his thesis, which focuses mostly on hardware browser fingerprinting and web tracking.
Tomer Laor is a MSc student at Ben Gurion University under the guidance of Dr. Yossi Oren. His main research interest is privacy, with an emphasis on hardware fingerprinting on the web using Machine Learning.
View More Papers
Get a Model! Model Hijacking Attack Against Machine Learning...
Ahmed Salem (CISPA Helmholtz Center for Information Security), Michael Backes (CISPA Helmholtz Center for Information Security), Yang Zhang (CISPA Helmholtz Center for Information Security)
ScriptChecker: To Tame Third-party Script Execution With Task Capabilities
Wu Luo (Peking University), Xuhua Ding (Singapore Management University), Pengfei Wu (School of Computing, National University of Singapore), Xiaolei Zhang (Peking University), Qingni Shen (Peking University), Zhonghai Wu (Peking University)
FANDEMIC: Firmware Attack Construction and Deployment on Power Management...
Ryan Tsang (University of California, Davis), Doreen Joseph (University of California, Davis), Qiushi Wu (University of California, Davis), Soheil Salehi (University of California, Davis), Nadir Carreon (University of Arizona), Prasant Mohapatra (University of California, Davis), Houman Homayoun (University of California, Davis)