Browser Recognition Method Based on CNN-Linformer Model

Abstract

The present invention discloses a browser recognition method based on the CNN-Linformer model. The method first extracts the temporal features of the input data through CNN, and then focuses on the important features through the linear attention of Linformer, thereby improving the accuracy of the model. The method also performs parallel calculations on the data through multi-head attention, thereby improving the training speed of the model. At the same time, the Linformer is simplified by deleting the decoder part, input embedding part and position encoding part in the Linformer, thereby reducing the complexity of the model and improving the calculation speed. In addition, in view of the problem that other existing methods do not fully consider the accuracy drop caused by various pseudo-fingerprint technologies, the present invention utilizes two pseudo-fingerprint technologies, randomizing attribute values and adding noise, to perform data enhancement on the original data set, and then uses the enhanced data set containing normal fingerprints and pseudo-fingerprints to train the CNN-Linformer model. This method has the advantages of high accuracy and fast recognition speed, and has good robustness in pseudo-fingerprint scenarios.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to a browser recognition method based on a CNN-Linformer model. Background Art

[0002] Websites often need to track user browsers for business purposes, including personalized advertising, content personalization, and network security. Servers and browsers typically use cookies to provide information for subsequent website services. However, in recent years, cookie technology has caused a growing number of problems. For example, cookies are stored locally on the user's machine, which can easily lead to the loss of user information. As cookie technology becomes increasingly inefficient, browser fingerprinting has gradually become the new mainstream technology for browser tracking.

[0003] A browser fingerprint is a collection of all browser-related information that can be collected through a browser. This includes information such as browser version, screen resolution, browser plug-ins, system fonts, and time zone, and can be used to identify a user's browser. Browser fingerprinting relies on the unique fingerprint of the browsing device itself. However, browser devices change rapidly and frequently, which can result in a new fingerprint that is completely different from the previous one. Therefore, relying solely on fingerprint uniqueness is insufficient for tracking. Accurately identifying browser fingerprints before and after changes becomes crucial.

[0004] Because browser fingerprinting collects client-side information, which can change as users modify client configurations or update browser versions, long-term user tracking requires identifying the constantly changing fingerprints of users' browsers. Besides objective factors like browser versions causing changes in browser fingerprints, some anti-browser fingerprinting software actively alters certain features, necessitating improved accuracy in identifying these browser fingerprints.

[0005] Traditional dynamic browser fingerprinting methods use statistics and traditional machine learning algorithms, such as the random forest algorithm, but these methods have low accuracy. There are also dynamic browser fingerprinting methods that use deep learning algorithms, such as the Recurrent Neural Network (RNN) algorithm and the Long Short-Term Memory (LSTM) algorithm. However, these algorithms can only process incoming data sequentially and have difficulty handling very high-dimensional and sparse input data, such as browser fingerprints containing a large number of features. Furthermore, sequential data processing reduces the algorithm's efficiency. Summary of the Invention

[0006] In order to identify the ever-changing fingerprints of user browsers, improve the accuracy and efficiency of fingerprint recognition algorithms, and address the problem of pseudo fingerprints generated by anti-browser fingerprint tracking software, the present invention proposes a browser recognition method based on the CNN-Linformer model. By generating pseudo fingerprints, the original dataset is expanded to form an enhanced dataset for model training, thereby improving the robustness of the fingerprint recognition algorithm.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] The present invention provides a browser recognition method based on a CNN-Linformer model, comprising the following steps:

[0009] For an unknown fingerprint fu, first traverse each fingerprint chain c in the fingerprint chain set C k = <f k，t , f k，t-1 , f k，t-2 , f k，t-3 >, the unknown fingerprint fu and fingerprint chain c k Generate input vector V using the Generate Input Vector algorithm input =[I t , I t-1 ,...,I t-i+1 ], where i is the length of the fingerprint chain, t is the current timestamp, I t =diff <f t-1 , f t > represents the comparison result of two fingerprints, diff represents a single feature vector I consisting of M features <x1,x2,...,x M >, x n is the comparison result of the nth feature of two fingerprints; the fingerprint chain is formed by linking fingerprints with the same ID according to the time of fingerprint acquisition. Each browser fingerprint has an ID, which is associated with the browser instance with the same ID. A browser instance has one fingerprint chain; the fingerprint chain set C contains all fingerprints linked to the browser instance;

[0010] Then V input Input the CNN-Linformer model, extract the temporal features of the input data through CNN, then use the linear attention of Linformer to focus on important features, and use multi-head attention to parallelly calculate the data to obtain the unknown fingerprint f u Whether it belongs to fingerprint chain c k The probability p; if p>λ, it means the unknown fingerprint f u Belongs to fingerprint chain c k , the fingerprint chain ck The ID is assigned to the unknown fingerprint f u , and the unknown fingerprint f u Insert fingerprint chain c k At the end of the , delete the fingerprint chain c k The fingerprint of the head; if p≤λ, a new ID is generated and assigned to f u , and generate a new fingerprint chain <f u > is added to the fingerprint chain set C, where λ is the set probability threshold; the CNN-Linformer model includes a reshaping layer Bridge, which is used to reshape the output from the CNN to match the input size of the Linformer; the Linformer layer only uses one encoder block, and the output of the Linformer finally passes through a linear layer activated by Softmax to produce a binary classification result.

[0011] Furthermore, in the CNN-Linformer model, the CNN module uses two convolutional layers to extract the temporal features of the input data, and reshapes the output of the last convolutional layer through the Bridge module to match the input V of the Linformer module. new ; The Linformer module only uses the encoder part of the Linformer, and only uses 1 encoder block.

[0012] Furthermore, the steps for constructing the CNN-Linformer model are as follows:

[0013] (1) Dataset selection: The browser fingerprint dataset is used as the original dataset F raw ;

[0014] (2) Data enhancement: Use pseudo fingerprint technology to enhance the original data set F raw Perform data enhancement to obtain enhanced data set F aug ;

[0015] (3) Data preprocessing: According to the rules, the enhanced dataset F aug The fingerprints in the dataset are filtered to obtain the browser fingerprint dataset F temp , and the browser fingerprint dataset F temp Perform feature regularization;

[0016] (4) Feature selection: Feature selection is performed based on the information entropy of the fingerprint features, and the selected fingerprint features and the features obtained during data enhancement are combined to form multiple fingerprint comparison vectors with time series relationships;

[0017] (5) Generate input vector: Convert multiple fingerprint comparison vectors with time sequence relationships into a two-dimensional matrix V input =[I t, I t-1 ,...,I t-i+1 ], as the input vector of the CNN-Linformer model, where i is the length of the fingerprint chain, t is the current timestamp, and I t =diff <f t-1 , f t > represents the comparison result of two fingerprints, diff represents a single feature vector I consisting of M features <x1,x2,...,x M >, x n It is the comparison result of the nth feature of two fingerprints. The diff method uses the method of calculating the absolute value of the difference between the two features;

[0018] (6) Training CNN-Linformer model: Constructing dataset F temp Positive and negative samples are used as a new data set F for subsequent training and testing. 20% of the data in the new data set F are randomly selected as the training set, and the remaining 80% are used as the test set. The model is trained using the training data, and the trained model is obtained and saved. The model is then used to classify the test data, and the classification results are obtained and analyzed.

[0019] Furthermore, step (2) performs pseudo-fingerprinting on the original dataset F by randomizing attribute values or adding noise. raw Perform data augmentation.

[0020] Furthermore, in step (3), the method for screening fingerprints is:

[0021] For the enhanced dataset F aug , F aug Each browser fingerprint f in has a browser ID linked to the browser instance to which it belongs, and all fingerprints of the browser instance form the set F id , where id is the id of the browser instance; for each If F id If it does not meet the rules 1 and 2, then delete F aug All fingerprints f∈F id , and finally get a new browser fingerprint dataset F temp ;

[0022] in:

[0023] Rule 1: If the number of fingerprints associated with a browser instance is less than 6, all fingerprints of the browser instance will be deleted;

[0024] Rule 2: If the operating system type attributes of all fingerprints associated with a browser instance are not exactly the same, all fingerprints of the browser instance will be deleted.

[0025] Furthermore, in step (3), the feature regularization method is as follows:

[0026] For numerical type features, minimum and maximum normalization is used for processing;

[0027] For Boolean type features, use binary representation of 0 and 1;

[0028] For string type features, they are first converted to numerical values and then processed using minimum and maximum normalization. For strings that cannot be directly converted to numerical values, the hash algorithm in the hashlib library in Python is used to map the strings to numerical values and then process them using minimum and maximum normalization.

[0029] For canvas, the hash algorithm in the hashlib library in Python is first used to map the string to a numerical value, and then the minimum and maximum normalization is used for processing.

[0030] Furthermore, in step (5), the algorithm steps for generating the input vector are as follows:

[0031] First, create an empty V input ; Secondly, traverse c k = <f k，t , f k，t-1， f k，t-2 , f k，t-3 >The fingerprint f in k，i , f u and f k，i Perform comparison operation to obtain comparison result I i =diff <f u , f k，i >= <x1,x2,...,x M > and merge the result into V input In; if c k If the length of the fingerprint chain is less than 4, V zero To add, V zero =<0, 0, ... 0>; the final generated input two-dimensional matrix V input Expressed as:

[0032]

[0033] Furthermore, in the Linformer module of the CNN-Linformer model, a Dropout module is placed after the last layer.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] (1) In the existing browser fingerprint recognition methods, the algorithms they use are all sequential processing algorithms, such as random forest, RNN, LSTM, etc., which can only process data sequentially. The present invention designs a new browser recognition model, combines the convolutional neural network (CNN) and Linformer, and proposes a browser fingerprint recognition algorithm based on the CNN-Linformer model to calculate the probability of whether an unknown fingerprint belongs to a certain fingerprint chain. It can process multiple inputs at a time and is good at processing high-dimensional and sparse input data. In the method of the present invention, a new input matrix construction algorithm is used to convert multiple inputs into two-dimensional matrices, which can be simultaneously input into the model for training or testing. CNN is used to extract features from time series data, and Linformer is used to further calculate these features to make predictions. Among them, the core of Linformer is the linear attention mechanism, which enables it to more effectively capture the complex connections and interactions in the data. In addition, the Linformer is optimized by removing the decoder, input embedding, and position encoding parts of the Linformer. The CNN results are reshaped and directly fed into the Linformer encoder for calculation, which reduces the complexity of the model and increases the speed of calculation. Overfitting is prevented by adding a Dropout layer after the Linformer decoder.

[0036] (2) To address the problem of anonymous browsers using pseudo-fingerprint generation technology to change browser fingerprints in order to avoid browser fingerprint tracking, thereby reducing the success rate of fingerprint recognition, this paper comprehensively analyzes common pseudo-fingerprinting technologies and tools, and uses these pseudo-fingerprinting technologies to enhance the original dataset. The enhanced dataset containing normal and pseudo-fingerprints is used to train the CNN-Linformer model, improving the robustness of browser fingerprint recognition in the pseudo-fingerprint scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0038] Figure 1 Flowchart of the browser fingerprint recognition method based on the CNN-Linformer model provided in an embodiment of the present invention.

[0039] Figure 2 This is a flow chart of the browser fingerprint recognition process provided by an embodiment of the present invention.

[0040] Figure 3 This is a structural diagram of the CNN-Linformer model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] The present invention proposes a browser recognition method based on the CNN-Linformer model, such as Figure 1 As shown in the figure, the original data set is first processed, feature selection is performed, and then the training set and test set are divided. The model is then trained using the training data, the trained model is obtained and saved, and the test data is then classified using the model to obtain the classification results and analyze the results.

[0043] The specific browser fingerprint recognition process is as follows Figure 2 As shown. In a real environment, we assign an ID to all browsers connected to a server, and the ID can uniquely identify a browser. We call the browser with the ID a browser instance. In this method, each browser fingerprint has an ID, which is associated with the browser instance with the same ID. We link the fingerprints with the same ID according to the time of fingerprint acquisition to form a fingerprint chain. A browser instance has a fingerprint chain. We will maintain a fingerprint chain set, which contains all fingerprints linked to the browser instance. For an unknown fingerprint f u To identify the fingerprint, the fingerprint matching algorithm is shown in Algorithm 1:

[0044]

[0045] Where C is the fingerprint chain set, λ is the set probability threshold, in this method λ = 0.5. In Algorithm 1, first traverse each fingerprint chain c in the fingerprint chain set C. k = <f k，t , f k，t-1 , f k，t-2 , f k，t-3 >, f u and c k Generate input vector V using Algorithm 2 (see Generating Input Vector for details) input , and then get f through the CNN-Linformer modelu Is it c k The probability p. If p>λ, then f u Belong to c k , c k Assign the ID to f u , and f u Insert c k At the end of k The fingerprint of the head (i.e. the earliest fingerprint added); if p≤λ, a new ID is generated and assigned to f u , and generate a new fingerprint chain <f u >Add to fingerprint chain set C.

[0046] Compared to other browser fingerprinting methods, the browser fingerprinting process designed in this method eliminates the rule-based pre-identification component. Because these rules are coarse-grained and artificially formulated, they have a high recognition error rate. Furthermore, pseudo-fingerprinting techniques often forge fingerprint features with high information entropy, which are often assumed to be constant in the rules, leading to incorrect recognition of pseudo-fingerprints. Therefore, we utilize a deep learning algorithm as the core, removing the coarse-grained rules. This not only simplifies the fingerprinting process but also improves recognition accuracy.

[0047] The following is a detailed description of the steps to build a CNN-Linformer model:

[0048] (1) Dataset: This method uses the browser fingerprint dataset in the FPStalker project released by the Spirals team on Github. There are 15,000 browser fingerprints in this dataset, and this method uses these fingerprints as the original dataset F raw .

[0049] (2) Data enhancement: In order to get rid of browser fingerprint tracking, some anonymous browsers use pseudo-fingerprint generation technology to change the browser fingerprint, thereby reducing the success rate of fingerprint recognition. In order to improve the robustness of browser fingerprint recognition in the pseudo-fingerprint scenario, it is necessary to simulate the measures taken by pseudo-fingerprint technology to prevent users from being tracked. We conducted a comprehensive analysis of common pseudo-fingerprinting technologies and tools, and used these pseudo-fingerprinting technologies to analyze the original dataset F. raw Perform data augmentation.

[0050] Common pseudo-fingerprinting techniques fall into two categories: (I) Tools like FPGuard and PriVaricator randomize certain fingerprint feature values, making each collected information unique; (II) Tools like FPRandom add noise to WebGL, Canvas, and other image data, making each collected information unique. Regarding both randomizing attribute values and adding noise, the specific data enhancement methods in the embodiments of the present invention can employ the following methods:

[0051] Tools like FPGuard prevent Flash-based font enumeration by disabling Flash. The absence of Flash can be used as fingerprint information. Therefore, Flash-related attribute values, such as Flash fonts, Flash resolution, and Flash language, can be added as fingerprint features during feature filtering. However, for ease of feature processing, only the easily quantifiable attribute value, Flash resolution, can be used as the fingerprint feature.

[0052] b. For tools like DCB that use real fingerprints as fake fingerprints, it is possible to forge basic fingerprint features with high information entropy, such as User-Agent, Language, and Fonts. This requires obtaining real data from the fingerprint features in the current fingerprint database and then replacing the fingerprint feature values to create a fake fingerprint.

[0053] c. Regarding tools like PriVaricator that filter a single entry in the navigator.plugin property and return a random subset of the actual plugin list, we can use the union of the plugin properties of all fingerprints in a fingerprint chain as the plugin set for that fingerprint chain. We can then randomly extract some plugins from the plugin set as a subset, requiring the number of plugins in this subset to be smaller than the total number of plugins in all fingerprints. Finally, we use this subset to replace the plugin properties of some fingerprints in the same fingerprint chain, thereby constructing a fake fingerprint.

[0054] d. For tools like FireGloves that limit the number of fonts that can be retrieved, we can construct a font subset and forge fingerprints using the same method as in c.

[0055] e. Tools like FireGloves require indirect access to browser functionality through JavaScript functions. Therefore, the use of JavaScript objects can be used to identify pseudo-fingerprinting tools like FireGloves. During feature filtering, you can add relevant attribute values of JavaScript objects, such as localStorage, as fingerprint features.

[0056] f. Regarding the situation where tools such as FPRandom add noise to Canvas and WebGL fingerprints. When collecting a browser fingerprint, you can create two Canvas (WebGL) images in succession and check whether there is a difference in the generated Canvas (WebGL) image data to determine whether there is Canvas noise. Since Canvas and WebGL images are too large, you can perform a difference calculation when collecting information and use the difference result as one of the browser fingerprint features. This article names the difference result CanvasDiff (WebGLDiff), which takes a value of 0 or 1, where 0 represents the same and 1 represents different. When constructing a pseudo fingerprint, randomly select some browser instances, set the CanvasDiff (WebGLDiff) of the fingerprints of these instances to 1, and set the remaining instances to 0.

[0057] g. Fingerprint features such as Screen resolution, Timezone, and Content-Encoding can be changed according to the real data in the fingerprint library, but these features cannot be replaced at the same time in the same pseudo fingerprint each time a pseudo fingerprint is constructed.

[0058] h. It is required that each time a pseudo fingerprint is constructed, the number of eigenvalues replaced in a pseudo fingerprint cannot be greater than 3.

[0059] Finally, we transform the original dataset F raw Expanded to 20,000 fingerprints as enhanced dataset F aug .

[0060] (3) Data preprocessing:

[0061] a. Screening fingerprints. In order to better train the CNN-Linformer model, the fingerprints in the dataset need to be restricted according to the rules. aug , F aug Each browser fingerprint f in has a browser ID linked to the browser instance to which it belongs, and all fingerprints of the browser instance form the set F id , where id is the id of the browser instance. If F id If it does not meet the rules 1 and 2, then delete F aug All fingerprints f∈F id Finally, we get a new browser fingerprint dataset F temp . Rules 1 and 2 are as follows:

[0062] Rule 1. If the number of all fingerprints associated with a browser instance is less than 6, all fingerprints of the browser instance will be deleted.

[0063] Rule 2: If the operating system type attributes of all fingerprints associated with a browser instance are not identical, all fingerprints of the browser instance are deleted.

[0064] b. Feature regularization. There are several types of features in browser fingerprints: 1. Numeric type, 2. Boolean type, 3. String type. 4. Canvas

[0065] 1) For numerical types, min-max normalization is used. For a numerical type feature value x in the browser fingerprint, traverse F temp All x in the result is a sequence x1, x2, x3, ..., x n , where n is F temp The number of fingerprints in the sequence x1, x2, x3, ..., x n Perform the transformation:

[0066]

[0067] Get the new sequence y1, y2, y3, ..., y n ∈[0, 1].

[0068] 2) For Boolean types, use binary representation of 0 and 1.

[0069] 3) For string types: For dates like creationDate, convert them to numeric values first and then normalize them using the method in 1. For dates that cannot be directly converted to numeric values, use a hash algorithm such as SHA256 from the Python hashlib library to map the string to an 8-bit value, then normalize it using the method in 1.

[0070] 4) For canvas, first perform the SHA256 hash algorithm to map the string to an 8-bit value, and then regularize it using the method in 1.

[0071] Compared to other methods for processing browser fingerprint features, this method is simpler and easier to use. For browser fingerprinting, fingerprint recognition speed is a key indicator of algorithm quality, so simple and efficient data preprocessing methods can reduce data processing time and thus increase fingerprint recognition speed.

[0072] (4) Feature selection: The fingerprints collected by the browser fingerprint collection script have many features, and there will be many redundant features in these features. When training the CNN-Linformer model, having too many features does not guarantee better results and may even lead to overfitting. In order to select which attributes constitute the feature vector, this method will perform feature selection based on the information entropy of the fingerprint features. Alejandro et al. (A Gómez-Boix, P. Laperdrix, and B. Baudry. "Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale." World Wide Web Conference 2018) collected 1,816,776 browser fingerprints as a data set to calculate the information entropy of different browser fingerprint features. The results are shown in Table 1. We will select the 16 fingerprint features in Table 1 and the 4 features added during data augmentation: Flashresolution, localStorage, CanvasDiff, WebGLDiff, a total of 20 features to constitute the feature vector for training the CNN-Linformer model.

[0073] Table 1 Browser fingerprint feature entropy values

[0074]

[0075] (5) Generate input vector: To pass data into CNN, we convert multiple fingerprint comparison vectors with time series relationships into a two-dimensional matrix similar to an image as input. input =[I t , I t-1 ,...,I t-i+1 ] as the input vector, where i is the length of the fingerprint chain and t is the current timestamp. t =diff <f t-1 , f t > represents the comparison result of two fingerprints, diff represents a single feature vector I consisting of M features <x1,x2,...,x M >, x n is the result of comparing the nth feature of the two fingerprints. In this method, since all browser fingerprint features have been converted to numerical values and normalized, the diff method uses the absolute value of the difference between the two features. The specific steps of the input vector generation algorithm are shown in Algorithm 2.

[0076]

[0077] First, create an empty V input . Secondly, traverse c k = <f k，t , f k，t-1 , f k，t-2 , f k，t-3 >The fingerprint f in k，i , f u and f k，i Perform comparison operation to obtain comparison result I i =diff <f u , f k，i >= <x1,x2,...,x M > and merge the result into V input If c k The length of (i.e. the number of fingerprints in the fingerprint chain) is less than 4, we will generate V zero To add, V zero =<0, 0, ... 0>. Finally, the input two-dimensional matrix V generated by Algorithm 2 input as follows:

[0078]

[0079] In this method, the number of fingerprints associated with a browser instance is at least 4, and a fingerprint has 20 features, so V input is a 4×20 matrix.

[0080] Other browser fingerprinting methods use sequential processing algorithms, such as random forests, RNNs, and LSTMs. In this method, by converting multiple inputs into two-dimensional matrices, we can simultaneously feed them into the model for training or testing, thus improving the efficiency of fingerprinting.

[0081] (6) Training CNN-Linformer model: This method trains the dataset F temp Positive and negative samples were constructed using the existing method (Li, Xiaoyun, et al. "Constructing browser fingerprint tracking chain based on LSTM model." 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC). IEEE, 2018). A total of 136,914 positive samples and 136,041 negative samples, totaling 272,955 samples, were obtained as a new dataset F for subsequent training and testing. 20% of the data in the new dataset F was randomly selected as the training set, and the remaining 80% was used as the test set.

[0082] The CNN-Linformer model constructed by the present invention is as follows Figure 3 As shown. This model is a combination of CNN and Linformer and is designed for binary classification tasks. The input is a two-dimensional matrix V input , where one dimension is time series data and the other dimension is the features of browser fingerprints. CNN extracts features from time series data, and then Linformer calculates these features to make predictions. The model includes a reshaping layer Bridge, which is used to reshape the output from CNN to match the input size of Linformer. We will V input The data processed by the CNN module and the Bridge module is represented as V new After that, V new The data is passed to the Linformer layer, which processes the data and produces an output. The output of the Linformer is finally passed through a linear layer activated by Softmax to produce a binary classification result.

[0083] The following introduces the model from two parts: CNN and Linformer.

[0084] a. CNN module: CNN can perform convolution and pooling operations on input data, extract important features from the input data, and help capture spatial and temporal information related to classification tasks. CNN can process data in parallel on multiple GPUs or CPUs, and is suitable for large-scale training on large data sets, thereby improving the training efficiency of the model. The specific architecture of the CNN of the present invention is shown in Table 1. It uses two convolutional layers to extract the temporal features of the input data, and in order to ensure that the time dimension of the input data remains unchanged and allow the subsequent Linformer to further extract features, we abandon the pooling layer and instead use Figure 3 The Bridge module in the convolutional layer reshapes the output of the last convolutional layer into an input V that can be used for the Linformer module. new . V new It is a 4×320 matrix.

[0085] Table 1 CNN architecture

[0086] layer type Output shape Activation Function parameter conv2d Conv2D (None, 4, 20, 10) ReLU 50 conv2d_1 Conv2D (None, 4, 20, 20) ReLU 820 reshape Reshape (None, 4, 400, 1) - 0

[0087] b. Linformer module: In the task of browser fingerprinting, the input is usually a series of data points with different characteristics, which may be scattered at different positions in the input sequence. By adopting the linear attention mechanism, the Linformer model can better capture this scattered information and use this information to improve the accuracy and robustness of fingerprinting. Specifically, the linear attention mechanism allows the Linformer model to weight different positions of the input in order to pay more attention to the information that is more important for a specific task. Compared with the traditional self-attention mechanism, this mechanism has lower time and space complexity, and therefore can improve the efficiency of fingerprinting. Multi-head linear attention enables the Linformer to process input data in parallel.

[0088] In order to be suitable for the browser fingerprint recognition task, the present invention modifies the Linformer model: in order to reduce the complexity of the model, we delete the decoder part of the Linformer model and only use the encoder part of the Linformer, and only use one encoder block, namely Figure 3 The dotted part of the Linformer module in Figure 1 has N=1. Since the output of the CNN part can be directly input into the Linformer-encoder for the next step of calculation without further processing, we deleted the input embedding and position encoding parts in the Linformer. The structure of the modified Linformer model is as follows Figure 3 The parameter settings of the Linformer model are shown in Table 2.

[0089] Table 2. Parameter settings of the Linformer model

[0090] Number of encoders 1 Number of multi-head attention heads 5 Feedforward network layer dimensions 64

[0091] c. Dropout layer: To prevent overfitting, a Dropout module is placed after the last layer normalization module. In this method, Dropout = 0.1.

[0092] d. Linear layer: The linear layer uses the Relu function. Relu is a nonlinear activation function that, compared to linear activation functions, better expresses complex classification boundaries and is more consistent with the signal excitation principle of neurons, which can improve model performance. In addition, Relu helps reduce vanishing states and error gradient issues.

[0093] e. Output layer activation function: sigmoid. In binary classification problems, sigmoid is often used as an activation function. The characteristic of sigmoid is that it maps the output to [0, 1], which can be easily matched with the probability and can be easily used to reflect the probability of the binary classification result. The output layer finally outputs f u The probability p of belonging to a certain fingerprint chain.

[0094] f. Loss function: Binary Cross Entropy function. Binary cross entropy loss function is often used to deal with binary classification problems. Its calculation formula is as follows:

[0095]

[0096] Where y is a binary label 0 or 1, and p(y) is the probability that the output belongs to the y label.

[0097] g. Optimizer: Adam. We used Adam as the optimization algorithm when building the model. Adam is a first-order optimization algorithm that can replace the traditional stochastic gradient descent process. It iteratively updates the neural network weights based on the training data.

[0098] This paper proposes a browser fingerprint recognition algorithm based on the CNN-Linformer model, which is used to calculate the probability that an unknown fingerprint belongs to a particular fingerprint chain. The CNN-Linformer model first extracts temporal features of the input data using a CNN, then uses the Linformer's linear attention to focus on important features, improving the model's accuracy. Multi-head attention is used to perform parallel computations on the data, increasing the model's training speed. The Linformer is simplified by removing its decoder, input embedding, and position encoding components, reducing its complexity and improving computational speed. Using the CNN-Linformer model, the browser fingerprint recognition accuracy was improved to 99.78%. Under the same experimental conditions, the CNN-Linformer-based browser fingerprint recognition algorithm took 2830 seconds to identify 2000 browser fingerprints, a 22.57% reduction compared to 3655 seconds for an LSTM, 36.86% reduction compared to 4482 milliseconds for a BiGRU, and 65.8% reduction compared to 8275 seconds for an FPStalker. These results demonstrate the advantages of high accuracy and fast recognition speed.

[0099] At the same time, in order to address the problem that other existing methods do not fully consider the accuracy drop caused by various pseudo-fingerprint technologies, the present invention utilizes two pseudo-fingerprint technologies, randomizing attribute values and adding noise, to enhance the original data set, and then uses the enhanced data set containing normal fingerprints and pseudo-fingerprints to train the CNN-Linformer model. This method not only uses pseudo-fingerprint technology for data enhancement, but also uses Flash resolution, localStorage, CanvasDiff, and WebGLDiff as fingerprint features. These newly added features can identify which pseudo-fingerprint technologies the user has used, and also consider pseudo-fingerprint technology as part of the fingerprint. Ultimately, the accuracy of the CNN-Linformer model reached 99.73%, the recall rate reached 99.83%, the F1 value reached 99.78%, and the MCC value reached 98.89%. These results show that this method has good robustness in the pseudo-fingerprint scenario.

[0100] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A browser recognition method based on CNN-Linformer model, characterized in that: The steps include: For an unknown fingerprint f u , first traverse each fingerprint chain c in the fingerprint chain set C k =< f k,t ,f k,t-1 ,f k,t-2 ,f k,t-3 >, the unknown fingerprint f u and fingerprint chain c k Generate input vector V using the Generate Input Vector algorithm input =[I t ,I t-1 ,...,I t-i+1 ], where i is the length of the fingerprint chain, t is the current timestamp, I t =diff <f t-1 ,f t > represents the comparison result of two fingerprints, diff represents a single feature vector I consisting of M features <x1,x2,...,x M >, x n is the comparison result of the nth feature of two fingerprints. The diff method uses the method of calculating the absolute value of the difference between two features. The fingerprint chain is formed by linking fingerprints with the same ID according to the order of fingerprint acquisition. Each browser fingerprint has an ID, which is associated with the browser instance with the same ID. A browser instance has one fingerprint chain. The fingerprint chain set C contains all fingerprints linked to the browser instance. Then V input Input the CNN-Linformer model, extract the temporal features of the input data through CNN, then use the linear attention of Linformer to focus on important features, and use multi-head attention to parallelly calculate the data to obtain the unknown fingerprint f u Whether it belongs to fingerprint chain c k The probability p; if p>λ, it means the unknown fingerprint f u Belongs to fingerprint chain c k , the fingerprint chain c k The ID is assigned to the unknown fingerprint f u , and the unknown fingerprint f u Insert fingerprint chain c k At the end of the , delete the fingerprint chain c k The fingerprint of the head; if p≤λ, a new ID is generated and assigned to f u , and generate a new fingerprint chain <f u > is added to the fingerprint chain set C, where λ is the set probability threshold; the CNN-Linformer model includes a reshaping layer Bridge, which is used to reshape the output from the CNN to match the input size of the Linformer; the Linformer layer only uses one encoder block, and the output of the Linformer is finally passed through a linear layer activated by Softmax to produce a binary classification result; The steps for building the CNN-Linformer model are as follows: (1) Dataset selection: The browser fingerprint dataset is used as the original dataset F raw ; (2) Data enhancement: Use pseudo-fingerprint technology to randomize attribute values or add noise to the original dataset F raw Perform data enhancement to obtain enhanced data set F aug ; (3) Data preprocessing: According to the rules, the enhanced dataset F aug The fingerprints in the dataset are filtered to obtain the browser fingerprint dataset F temp , and the browser fingerprint dataset F temp Perform feature regularization; (4) Feature selection: Feature selection is performed based on the information entropy of the fingerprint features, and the selected fingerprint features and the features obtained during data enhancement are combined to form multiple fingerprint comparison vectors with time series relationships; (5) Generate input vector: Convert multiple fingerprint comparison vectors with time sequence relationships into a two-dimensional matrix V input =[I t ,I t-1 ,...,I t-i+1 ], as the input vector of the CNN-Linformer model; (6) Training CNN-Linformer model: Constructing dataset F temp Positive and negative samples are used as a new data set F for subsequent training and testing. 20% of the data in the new data set F are randomly selected as the training set, and the remaining 80% are used as the test set. The model is trained using the training data, and the trained model is obtained and saved. The model is then used to classify the test data, and the classification results are obtained and analyzed.

2. The browser recognition method based on the CNN-Linformer model according to claim 1, characterized in that: In the CNN-Linformer model, the CNN module uses two convolutional layers to extract the temporal features of the input data, and reshapes the output of the last convolutional layer through the Bridge module to match the input V of the Linformer module. new ; The Linformer module only uses the encoder part of the Linformer, and only uses 1 encoder block.

3. The browser recognition method based on the CNN-Linformer model according to claim 1, characterized in that: In step (3), the method for screening fingerprints is: For the enhanced dataset F aug , F aug Each browser fingerprint f in has a browser ID linked to the browser instance to which it belongs, and all fingerprints of the browser instance form the set F id , where id is the id of the browser instance; for each If F id If it does not meet the rules 1 and 2, then delete F aug All fingerprints f∈F id , and finally get a new browser fingerprint dataset F temp ; in: Rule 1: If the number of fingerprints associated with a browser instance is less than 6, all fingerprints of the browser instance will be deleted; Rule 2: If the operating system type attributes of all fingerprints associated with a browser instance are not exactly the same, all fingerprints of the browser instance will be deleted.

4. The browser recognition method based on the CNN-Linformer model according to claim 1 The method is characterized in that In step (3), the feature regularization method is as follows: For numerical type features, minimum and maximum normalization is used for processing; For Boolean type features, use binary representation of 0 and 1; For string type features, they are first converted to numerical values and then processed using minimum and maximum normalization. For strings that cannot be directly converted to numerical values, the hash algorithm in the hashlib library in Python is used to map the strings to numerical values and then process them using minimum and maximum normalization. For canvas, the hash algorithm in the hashlib library in Python is first used to map the string to a numerical value, and then the minimum and maximum normalization is used for processing.

5. The browser identification method based on the CNN-Linformer model according to claim 1, characterized in that: In step (5), the algorithm steps for generating the input vector are as follows: First, create an empty V input ; Secondly, traverse c k = <f k,t ,f k,t-1 ,f k,t-2 ,f k,t-3 >The fingerprint f in k,i , f u and f k,i Perform comparison operation to obtain comparison result I i =diff <f u ,f k,i >= <x1,x2,...,x M > and merge the result into V input In; if c k If the length of the fingerprint chain is less than 4, V zero To add, V zero =<0,0,...0>; the final generated input two-dimensional matrix V input Expressed as:

6. The browser identification method based on the CNN-Linformer model according to claim 1, characterized in that: In the Linformer module of the CNN-Linformer model, a Dropout module is placed after the last layer.

Images