Browser Engine Research Articles

FP-tracer: Fine-grained Browser Fingerprinting Detection via Taint-tracking and Entropy-based Thresholds

Browser fingerprinting is an effective technique to track web users by building a fingerprint from their browser attributes. It is also stealthy because the tracker uses legitimate JavaScript API calls offered by the browser engine, which can be obfuscated before they are sent to a (third-party) server. Current browser fingerprinting methodologies employ coarse-grained collection and classification techniques, such as binary classification of fingerprinters based on the number of non-obfuscated exfiltrated attributes. As a result, they produce inconsistent findings. Meanwhile, the privacy of millions of web users is at risk daily. We address this gap by presenting FP-tracer, a novel methodology to detect and classify browser fingerprinters based on dynamic taint tracking and joint entropy classification. Our methodology enables detecting first- and third-party fingerprinters even when they use obfuscation by tainting attributes, propagating them, and logging when they are leaked (via 62 sources and 25 sinks). Moreover, it discriminates the invasiveness of fingerprinting activities, even from the same service, by measuring the joint entropy of the collected attributes and clustering them. We implement FP-tracer by extending Foxhound, a privacy-oriented Firefox fork with numeric type tainting, more taint tracking sources and sinks, support for multiple sources, and better logging capabilities. We embed our implementation in our automated crawling infrastructure, which is capable of testing websites in parallel using programmable and reproducible logic. We will open-source our implementation. We evaluate FP-tracer by performing a large-scale crawl over the Tranco Top 100K, and detect, amongst others, audio, canvas, and storage fingerprinting on the web. Among others, we find high fingerprinting activities in 8% of domains, with more moderate activity reaching 75%. Notably, fingerprinting is almost five times more likely to be performed by third-party scripts for high activity levels. In addition, we measure that the most severe category of fingerprinting obfuscates 46% of transmitted attributes, and 38% of fingerprinters involve two or more domains. Finally, we find that existing consent banners do not provide an effective defense against browser fingerprinting

Cocoon: Static Information Flow Control in Rust

Information flow control (IFC) provides confidentiality by enforcing noninterference, which ensures that high-secrecy values cannot affect low-secrecy values. Prior work introduces fine-grained IFC approaches that modify the programming language and use non-standard compilation tools, impose run-time overhead, or report false secrecy leaks—all of which hinder adoption. This paper presents Cocoon, a Rust library for static type-based IFC that uses the unmodified Rust language and compiler. The key insight of Cocoon lies in leveraging Rust’s type system and procedural macros to establish an effect system that enforces noninterference. A performance evaluation shows that using Cocoon increases compile time but has no impact on application performance. To demonstrate Cocoon’s utility, we retrofitted two popular Rust programs, the Spotify TUI client and Mozilla’s Servo browser engine, to use Cocoon to enforce limited confidentiality policies

Исследование WebAssembly и сравнение производительности с JavaScript

Over the long history of the Internet, JavaScript has been the primary programming language in web development. Because of its simple syntax and support in all popular browsers, the language has gained popularity among the developers. However, as computer power and user demands evolved, simple sites turned into the web applications that are full-fledged analogues of the desktop applications. As capabilities grew, so did the performance requirements of such programs. Browser engines have developed ways to optimize the code they run, and intense competition between browsers has contributed to a qualitative increase in performance. Despite all the ways to increase the speed of execution of JavaScript code, the main stopping factor was the dynamic typing of the language. Because of dynamic typing, the browser engine needs to check each time the program is executed whether the variable is an integer, a float, or any other valid type. Thus, each JavaScript instruction has to go through several type checks and conversions, which slows down the execution. This led to the idea of using languages with strict typing, which could compensate for this drawback. But the browser engines cannot execute the code of other languages, that is why there appeared the technology WebAssembly. It allows writing code in languages with static typing, and then parses it into 
 a more native and machine-readable format, which speeds up execution of programs compared to JavaScript. The technology is cross-platform and supports the main programming languages: C++, C, Java, C#. WebAssembly is also implemented using JavaScript, which allows to use the concise JavaScript syntax and computing power of WebAssembly together.

Optimize along the way: An industrial case study on web performance

Context:Fast loading web apps can be a key success factor in terms of user experience. However, improving the performance of a web app is not trivial, since it requires a deep understanding of both the browser engine and the specific usage scenarios of the web app under consideration. Aims:In this paper, we present an industrial case study at 30 MHz, an agricultural technology company, in which we target a large web-based dashboard, where its performance was improved via 13 distinct interventions over a four-month period. Moreover, we conduct a user study to analyse whether web performance metrics correlate with the user perceived page load time in optimization scenarios. Methods:First, we design a replicable performance engineering plan, where the technical realization of each intervention is reported in detail along with its development effort. Second, we develop a benchmarking tool that supports 11 widely used web performance metrics. Finally, we use the benchmarking tool to quantitatively evaluate the performance of the target web app and measure the effect of 13 interventions on both desktop and mobile devices. For the user study, we record six videos of different page loads and ask participants about their opinion about the time a web page is considered ready. We calculate the correlation of the user perceived data with each web performance metric. Results:We observe a considerable performance improvement over the course of the 13 interventions. Among others, we achieve 98.37% and 97.56% time reductions on desktop and mobile, respectively, for the First Contentful Paint metric. In addition, we achieve 48.25% and 19.85% improvements for the Speed Index (SI) metric on desktop and mobile, respectively. Our user study shows that the Lowest Time to Widget metric, a product-specific web performance metric, is perfectly correlated with perceived performance during the optimization process. Conclusion:This study shows the importance of a continuous focus on performance engineering in the context of large-scale web apps to improve user browsing experience. We recommend developers to carefully plan their performance engineering activities, since different interventions might require different efforts and can have different effects on the overall performance of the web application.

Transaction Agreements Through Internet Media Electronic Systems (E-Commerce) in the Perspective of Civil Law and Islamic Law

E-Commerce or what is known as electronic commerce is a product in the digital era. E-Commerce Agreements have become a new color in the economic world, especially in providing convenience in making an agreement in a transaction . Like an agreement in general, but the difference is that the contract is not in one assembly. It is urgent to get a factual answer related to its validity in the dimensions of civil law and Islamic law. nik. This study is normative research with literature study. The results of this study indicate that: (1) Even though there is one of the legal conditions of the agreement that is not fulfilled, namely the qualification requirements of the parties, the agreement made by the merchant and customer remains valid and binding and becomes a law for merchants and customers because the skill requirements are included in subjective conditions where a condition is not fulfilled in the agreement. does not cause the agreement or contract to be invalid, but the agreement or contract can be requested for cancellation. Meanwhile, according to the Islamic perspective, it is permissible as long as it does not contain elements that can damage it, such as tyranny, fraud, cheating, containing usury, forbidden cases and the like and fulfilling the pillars and conditions of buying and selling. (2) Then, problems in the implementation of E-Commerce can actually be overcome by using technology assistance, including cryptography and digital signatures that are useful for providing guarantees of data authenticity, data confidentiality, and data validity using SSL (Secure Socket Layer) on the browser engine to provide security against eavesdropping. data in the process of electronic transactions. Cooperation between merchants and banks and account and credit card issuers to ensure the accuracy of the data submitted, especially regarding skills. Good faith from the merchant by using software that has been tested to always update the information submitted in order to provide correct information about the existence of the goods.

Assessing the Effective Communication Channels to Reduce Child and Adolescent Marriage in Rural Communities of Egypt

BACKGROUND: Low levels of scholarly achievement, poverty, and geographical isolation are all known to be linked to early marriage. AIM: This study aimed at identifying the most credible and the best-suited communication channels (CCs) to reach rural communities for motivating them to reduce child and adolescent marriage. METHODS: This study was a community-based cross-sectional systematic formative research. The study targeted 1000 wives who were ever married women in childbearing period aged 15–49 years and their husbands in 21 rural village units of two governorates of Upper Egypt through questionnaires. Decisions concerning the choice of the best-suited CCs were based on their reach, frequency, managerial feasibility, and effectiveness. The investigated CCs included: modern social media (search browser engine/Facebook group and/or twitter/YouTube or messaging through WhatsApp or any mobile app), traditional mass media (T.V/Radio/Reading), and interpersonal communication (talk with religious leaders/partners/friends/doctors/health promoters). Comparisons between different CCs were done using odds ratios (OR) and 95% confidence intervals (CI). RESULTS: A vast majority of the surveyed wives (96.6%) were married at an age ranging from 15 to 24 years. The spread of social media through smartphones was limited to only one-third of wives and their husbands through mainly searching on YouTube (31.7% of wives and 27.8% of husbands). Television was the most accessible means of mass media for both wives and husbands (72.5% and 63.3%, respectively). The most credible and the best-suited CCs methods for wives were talking with the health promotors and doctors with 2 times significantly higher (OR = 2.0, CI = 1.7–2.4 for each one) than that with the search on YouTube and 3 times significantly higher (OR = 3.1, CI = 2.5–3.7 and OR = 3.1, CI = 2.6–3.8, respectively) than that for social media using browser engine. For husbands, the odds of the most credible and the best-suited CCs methods were more than 1½ times higher for the talk with the health promotors than the search on You Tube (OR = 1.6, CI = 1.3–2.0) or the search using browser engine (OR = 1.6, CI = 1.3–1.9), Whereas the odds were one and a third higher for the talk with the doctor than the search on You Tube (OR = 1.3, CI = 1.1–1.6) or the search using browser engine (OR = 1.6, CI= 1.1–1.6). Significant difference was detected in favor of the traditional media as the most credible source of information only for wives’ intention to postpone their children early marriage. CONCLUSIONS: Despite the availability of recent social media worldwide, rural communities with high illiteracy have limited access to the internet and limited availability of smartphones. Interpersonal communication is considered their most effective CCs for achieving equity in reducing child marriage. It seems vital during the implementation of any strategies toward reproductive health to use not only the media broadcasts, but also to rely on the channels that are most credible and suitable for the targeted communication to support meeting the unmet need.

Search methods for abnormal activities of web applications

Subject of Research. The paper presents a review of existing detection methods for abnormal activities of web applications. Comparative characteristics are given. Priorities for improving information security tools in web applications are shown. Method. For evaluation of search methods for abnormal activities of web applications, criteria for selecting indicators were defined. Particular attention was paid to such indicators as: the launching speed of web applications after loading, web application responsiveness to user actions and the number of abnormal activities found in comparison with the number of malfunctions found. Three methods of searching for abnormal activities were compared: statistical code scanning, dynamic code scanning and network traffic monitoring. We considered advantages and disadvantages of each method and implementation examples. Main Results. It is shown that the dynamic method of searching for abnormal activities has the best characteristics. The method provides the identification of anomalies associated with traffic transfer and anomalies that occur during the local operation of web applications. The method is implemented as a code analyzer built into the browser engine. The analyzer checks all calls of the web application to the engine and detects abnormal activity based on such calls. In contrast to static scanning, dynamic scanning identifies anomalies in Web Workers, WebAssembly and in the parts of code that are downloaded over the network after the application starts. Practical Relevance. The work can be useful to information security specialists who deal with the problems of protecting web applications, as well as programmers and system administrators at application creation and implementation stage. The results of the work can find practical use in the development of web applications, browsers, and information protection software.

After you, please: browser extensions order attacks and countermeasures

Browser extensions are small applications executed in the browser context that provide additional capabilities and enrich the user experience while surfing the web. The acceptance of extensions in current browsers is unquestionable. For instance, Chrome’s official extension repository has more than 63,000 extensions, with some of them having more than 10M users. When installed, extensions are pushed into an internal queue within the browser. The order in which each extension executes depends on a number of factors, including their relative installation times. In this paper, we demonstrate how this order can be exploited by an unprivileged malicious extension (i.e., one with no more permissions than those already assigned when accessing web content) to get access to any private information that other extensions have previously introduced. We propose a solution that does not require modifying the core browser engine, since it is implemented as another browser extension. We prove that our approach effectively protects the user against usual attackers (i.e., any other installed extension) as well as against strong attackers having access to the effects of all installed extensions (i.e., knowing who did what). We also prove soundness and robustness of our approach under reasonable assumptions.

KKN SISDAMAS: OPTIMALISASI PEMBERDAYAAN MASYARAKAT MELALUI PENGGUNAAN SMARTPHONE UNTUK MARKETPLACE

Comprehensive studies on community empowerment using smart phone in Indonesia, especially in villages in West Java, are still limited. This research is to investigate how the students joining KKN Sisdamas implemented the program of community empowerpent through the use of smarphone for village development in Desa Cikoneng, Kecamatan Ganeas, Sumedang District, West Java. This research adopts the cycles of KKN Sisdaman proposed by Sururie, et al. The data were collected through observation to 30 people using smartphone as ther life screening. The result shows that under the KKN Sisdamas Group 139 are successful in socializing, training, and guiding the community to use their smartphone for trading in marketplaces. There are six groups of trading in different marketplaces that sell different products. Some of which sell T-Shirt souvenirs, kunci, keranjang tahu, and kerecek. The community can operate—sell their own products after having their own accounts in marketplaces. Besides, they also can use some features and applications existing in smartphone to get and share the information through internet browser engine and youtube.

The JavaScriptCore virtual machine (invited talk)

JavaScriptCore (JSC) is an open-source high-performance implementation of JavaScript. JSC is used in the WebKit open source browser engine as well as a system framework on macOS and iOS. This talk will give a broad high-level overview of JSC’s performance-oriented architecture, including specific details about the object model, garbage collector, optimizing compilers, type inference, and deoptimization.

Optimizing General-Purpose CPUs for Energy-Efficient Mobile Web Computing

Mobile applications are increasingly being built using web technologies as a common substrate to achieve portability and to improve developer productivity. Unfortunately, web applications often incur large performance overhead, directly affecting the user quality-of-service (QoS) experience. Traditional techniques in improving mobile processor performance have mostly been adopting desktop-like design techniques such as increasing single-core microarchitecture complexity and aggressively integrating more cores. However, such a desktop-oriented strategy is likely coming to an end due to the stringent energy and thermal constraints that mobile devices impose. Therefore, we must pivot away from traditional mobile processor design techniques in order to provide sustainable performance improvement while maintaining energy efficiency. In this article, we propose to combine hardware customization and specialization techniques to improve the performance and energy efficiency of mobile web applications. We first perform design-space exploration (DSE) and identify opportunities in customizing existing general-purpose mobile processors, that is, tuning microarchitecture parameters. The thorough DSE also lets us discover sources of energy inefficiency in customized general-purpose architectures. To mitigate these inefficiencies, we propose, synthesize, and evaluate two new domain-specific specializations, called the Style Resolution Unit and the Browser Engine Cache. Our optimizations boost performance and energy efficiency at the same time while maintaining general-purpose programmability. As emerging mobile workloads increasingly rely more on web technologies, the type of optimizations we propose will become important in the future and are likely to have a long-lasting and widespread impact.

A comprehensive performance study of HTML5-enabled WebApps

Web applications (WebApps) built on top of HTML standards have the advantage of cross-platform portability. However, the user experience in terms of both functionality and performance provided by current generation WebApps is not comparable to native apps running on iOS or Android. Despite significant functional extensions in the new HTML5 standard, the poor performance of WebApps has not been addressed. To promote the adoption of WebApps, it is important to study their performance comprehensively. In this paper, we take Google Chrome as the target browsing engine, and evaluate its performance with a set of popular web pages and WebApps. We make in-depth analysis on the major performance-contributing aspects in a browser engine. Our study exposes a number of interesting observations, from which we make reasonings and provide suggestions for the optimisation of browser engines, as well as guidelines for developing efficient web-based applications.

FastIO: 스마트 TV 앱의 고속 구동 기법

스마트 TV는 콘텐츠를 제공하기 위해 웹 브라우저로 웹킷을 사용한다. 웹킷은 앱을 실행하기 위해 HTML, CSS, 자바스크립트, 이미지와 같은 웹 자원을 사용한다. 따라서 애플리케이션이 시작될 때 웹킷은 메모리로 자원을 적재하고 돔트리와 렌더트리를 생성한다. 하지만 스마트 TV 앱은 웹 자원을 디스크에 저장하기 때문에 돔트리와 렌더트리는 변하지 않는다. 그러므로 만약 돔트리와 렌더트리를 재사용할 수 있다면 앱의 로딩 시간을 단축할 수 있다. 본 논문은 동적으로 할당 받은 메모리에 영속성을 부여하는 기법인 FastIO를 제시하고 웹킷 기반의 웹 브라우저에 적용하였다. 따라서 웹 자원을 스토리지로부터 메모리로 적재하고 in-memory 구조로 변환하는 과정을 제거 하였다. 실험 결과로 돔트리와 렌더트리가 생성 과정까지의 시간을 비교하였고, FastIO를 적용한 웹 브라우저가 기존 웹 브라우저보다 SSD, Ramdisk, eMMC에서 7.9배, 44.8배, 2.9배의 속도가 향상되었다.

Concurrency in Mobile Browser Engines

browsers are one of the most pervasive applications for an entire range of personal computing platforms--from mobile devices to desktops. Using technologies (HTML, CSS, JavaScript) to build Web apps has the promise of creating portable applications for all platforms. Thus browsers become application containers, requiring increased performance from browser engines. Here, the authors discuss advances in browser technologies that exploit multicore processing. They use the Zoomm browser and the MuscalietJS JavaScript engine as running examples of highly concurrent browser and JavaScript engines. They show how concurrency is effectively exploited at different levels: to speed up computation performance, preload network resources, and preprocess resources outside the critical path to speed up page loading and workloads.

WebCore

The Web browser is undoubtedly the single most impor- tant application in the mobile ecosystem. An average user spends 72 minutes each day using the mobile Web browser. nWeb browser internal engines (e.g., WebKit) are also growing in importance because they provide a common substrate for developing various mobile Web applications. In a user-driven, interactive, and latency-sensitive environment, the browser's performance is crucial. However, the battery-constrained nature of mobile devices limits the performance that we can de- liver for mobile Web browsing. As traditional general-purpose techniques to improve performance and energy efficiency fall short, we must employ domain-specific knowledge while still maintaining general-purpose flexibility In this paper, we first perform design-space exploration to identify appropriate general-purpose architectures that uniquely fit the characteristics of a popular Web browsing engine. Despite our best effort, we discover sources of energy inefficiency in these customized general-purpose architectures. To mitigate these inefficiencies, we propose, synthesize, and evaluate two new domain-specific specializations, called the Style Resolution Unit and the Browser Engine Cache. Our opti- mizations boost energy efficiency and at the same time improve mobile Web browsing performance. As emerging mobile work- loads increasingly rely more on Web browser technologies, the type of optimizations we propose will become important in the future and are likely to have lasting widespread impact

클라우드 기반의 N-Screen 에뮬레이터 설계 및 구현

In this paper, we propose a new design scheme of N-Screen emulator based on Cloud and then implement the emulator, in order to solve the critical point of N-Screen emulator based on Cloud. This method, without the emulator in the server, will be able to confirm the features of the emulator with a browser using Web Service. This means that the identical service is possible without regard to personal computer or mobile environment. Also, in order to emulating each different web browser engine of the various devices separately, we revise and manage the WebKit engine to be suitable to the characteristics of each device. In the previous design method, the number of emulators which can be shown in a monitor is restricted to 2 or 3. However, we show that the proposed design method can improve the performance of server to the extent that this method could operate more than 100 emulators per each server.

ZOOMM

We explore the challenges in expressing and managing concurrency in browsers on mobile devices. Browsers are complex applications that implement multiple standards, need to support legacy behavior, and are highly dynamic and interactive. We present ZOOMM, a highly concurrent web browser engine prototype and show how concurrency is effectively exploited at different levels: speed up computation performance, preload network resources, and preprocess resources outside the critical path of page loading. On a dual-core Android mobile device we demonstrate that ZOOMM is two times faster than the native WebKit based browser when loading the set of pages defined in the Vellamo benchmark.

Flow-inspector: a framework for visualizing network flow data using current web technologies

New web technologies led to the development of browser applications for data analysis. Modern browser engines allow for building interactive real-time visualization applications that enable efficient ways to understand complex data. We present Flow-Inspector, a highly interactive open-source web framework for visualizing network flow data using latest web technologies. Flow-Inspector includes a backend for processing and storing large-scale network flow data, as well as a JavaScript-based web application capable to display and manipulate traffic information in real-time. This work provides operators with a toolkit to analyze their networks and enables the scientific community to create new and innovative visualizations of traffic data with an extensible framework. We demonstrate the applicability of our approach by implementing several different visualization components that help to identify topological characteristics in network flows.

A Comprehensive Survey of Event Analytics

Analytics has emerged as an important area of study as it avoids further incidents or risks after the events have occurred; this is done by analysing computer events and making further statistics. The purpose of this survey is to gain knowledge for the authors’ own event knowledge database which will consist of how unusual events work and how they are related to other events. The algorithms mentioned in this paper have been used to build their future development, resulting in a knowledge database designed to be similar to an internet browser engine where it can search events and their relationships. The research and algorithms have helped the authors to decide on the technology they will be using for the knowledge database.

Chameleon: A Color-Adaptive Web Browser for Mobile OLED Displays

Displays based on organic light-emitting diode (OLED) technology are appearing on many mobile devices. Unlike liquid crystal displays (LCD), OLED displays consume dramatically different power for showing different colors. In particular, OLED displays are inefficient for showing bright colors. This has made them undesirable for mobile devices because much of the web content is of bright colors. To tackle this problem, we present the motivational studies, design, and realization of Chameleon, a color adaptive web browser that renders webpages with power-optimized color schemes under user-supplied constraints. Driven by the findings from our motivational studies, Chameleon provides end users with important options, offloads tasks that are not absolutely needed in real time, and accomplishes real-time tasks by carefully enhancing the codebase of a browser engine. According to measurements with OLED smartphones, Chameleon is able to reduce average system power consumption for web browsing by 41 percent and is able to reduce display power consumption by 64 percent without introducing any noticeable delay.