利用事件循环粒度JavaScript签名改进Web内容阻塞
Improving Web Content Blocking With Event-Loop-Turn Granularity JavaScript Signatures
摘要：
内容拦截是一个高性能、用户服务、尊重隐私的网站的重要组成部分。大多数内容拦截器通过URL构建信任标签。虽然这种方法很有用，但也有众所周知的缺点。攻击者可以通过更改URL或域、将不需要的代码与良性代码捆绑在一起或在页面中内联代码来避免检测。现有方法的共同缺陷是它们基于代码的交付机制而不是其行为来评估代码。在这项工作中，我们解决这个问题的系统生成签名的隐私和安全相关的行为执行JavaScript。我们的系统在每次打开JavaScript事件循环时都会考虑脚本行为。专注于事件循环回合使我们能够构建强大的签名，以防止代码混淆，代码捆绑，URL修改和其他常见的规避，以及处理Web应用程序的独特方面。这项工作对改进内容阻塞做出了以下贡献：首先，实现了一个新的系统，通过检测Blink和V8运行时来构建JavaScript代码的每个事件循环签名。其次，我们将这些签名应用于测量过滤器列表规避，使用EasyList和EasyPrivacy作为基础事实，并找到其他行为相同的代码。我们从过滤器列表阻止的11，212个独特脚本中构建了约200万个隐私和安全行为签名，并发现了3，589个包含相同有害代码的独特脚本，影响了12.48%的网站。第三，我们分类常见的过滤器列表规避技术。最后，我们提出的防御措施，过滤器列表添加在可能的情况下，并建议，在其他情况下，基于签名的系统。我们分享了我们的签名生成系统的实现，将我们的系统应用到Alexa 100K的数据集，以及586个AdBlock Plus兼容的过滤器列表规则，以阻止当前被阻止的代码被移动到新的URL。
英文摘要：
Content blocking is an important part of a performant, user-serving, privacy respecting web. Most content blockers build trust labels over URLs. While useful, this approach has well understood shortcomings. Attackers may avoid detection by changing URLs or domains, bundling unwanted code with benign code, or inlining code in pages. The common flaw in existing approaches is that they evaluate code based on its delivery mechanism, not its behavior. In this work we address this problem with a system for generating signatures of the privacy-and-security relevant behavior of executed JavaScript. Our system considers script behavior during each turn on the JavaScript event loop. Focusing on event loop turns allows us to build signatures that are robust against code obfuscation, code bundling, URL modification, and other common evasions, as well as handle unique aspects of web applications. This work makes the following contributions to improving content blocking: First, implement a novel system to build per-event-loop-turn signatures of JavaScript code by instrumenting the Blink and V8 runtimes. Second, we apply these signatures to measure filter list evasion, by using EasyList and EasyPrivacy as ground truth and finding other code that behaves identically. We build ~2m signatures of privacy-and-security behaviors from 11,212 unique scripts blocked by filter lists, and find 3,589 more unique scripts including the same harmful code, affecting 12.48% of websites measured. Third, we taxonomize common filter list evasion techniques. Finally, we present defenses; filter list additions where possible, and a proposed, signature based system in other cases. We share the implementation of our signature-generation system, the dataset from applying our system to the Alexa 100K, and 586 AdBlock Plus compatible filter list rules to block instances of currently blocked code being moved to new URLs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
