• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文学位 >Improving Web Privacy And Security with a Cost-Benefit Analysis of the Web API
【24h】

Improving Web Privacy And Security with a Cost-Benefit Analysis of the Web API

机译：通过对Web API的成本效益分析来改善Web隐私和安全性

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Over the last two decades, the web has grown from a system for delivering static documents, to the world's most popular application platform. As the web has become more popular and successful, browser vendors have added increasingly more functionality into the web platform. While some of this functionality has proven very useful and allowed site authors to create applications that users enjoy, a large subset of functionality in the browser goes largely unused. Another sizable subset of functionality has been leveraged by malicious parties to harm browser users.;This dissertation presents an effort to improve web privacy and security by applying a cost- benefit analysis to the Web Application Programming Interface (API), as it is implemented in popular web browsers. The goal of the work is to apply the principal of "least privilege" to the web, and restrict websites to functionality they need to carry out user-serving ends. The work pursues that end through a novel method of measuring the costs and benefits associated with each standard in the Web API, identifying different high-benefit and low-risk subsets of the Web API, and evaluating a variety of approaches for restricting websites to these safer subsets.;This dissertation covers four distinct research efforts, each of which contribute to the over- all goal of improving privacy and security on the web. First, this dissertation describes an automated technique for measuring Web API use on the web by instrumenting the DOM in a commodity web browser, automating the browser to interact with websites in a manner that elicits most of the same feature use as human users encounter, and recording what functionality is triggered during this execution. This section also presents the results of applying this auto- mated recording methodology to the entire Alexa 10k, both in default browser configurations, and with popular blocking extensions installed. This dissertation covers four distinct research efforts, each of which contribute to the overall goal of improving privacy and security on the web. First, this dissertation describes an automated technique for measuring Web API use on the web by instrumenting the DOM in a commodity web browser, automating the browser to interact with websites in a manner that elicits most of the same feature use as human users encounter, and recording what functionality is triggered during this execution. This section also presents the results of applying this automated recording methodology to the entire Alexa 10k, both in default browser configurations, and with popular blocking extensions installed.;Finally, this work describes an alternate system for designing web applications that provides client-enforced privacy and security guarantees. The design of this system builds on the previously discussed per-standard cost-benefit methodology to determine which Web API features sites generally need.;Each of these works support the overarching finding that privacy and security on the web can be improved with only a small cost to the user experience. In contrast to the current practice of giving every site access to every feature in the browser (with only minor exceptions), this work presents a data driven approach to restricting websites to a subset of safer, user-serving functionality. This dissertation further shows that the privacy and security benefits of enforcing this "least privilege" approach to the Web API would be meaningful, and real world deployment of these techniques shows that at least some web users find the approach useful in protecting their privacy and security.
机译：在过去的二十年中，Web已从用于传递静态文档的系统发展为全球最受欢迎的应用程序平台。随着Web变得越来越流行和成功，浏览器供应商已将越来越多的功能添加到Web平台中。尽管某些功能被证明非常有用，并允许站点作者创建用户喜欢的应用程序，但浏览器中的大部分功能仍未使用。恶意方已利用了另一个相当大的功能子集来损害浏览器用户。本论文提出了通过对Web应用程序编程接口（API）进行成本效益分析来改善Web隐私和安全性的工作，流行的网络浏览器。该工作的目标是将“最低特权”原则应用于网络，并将网站限制为实现用户服务目的所需的功能。为此，工作采取了一种新颖的方法，即测量与Web API中的每个标准相关的成本和收益，识别Web API的不同高收益和低风险子集以及评估将网站限制在这些方面的各种方法。更安全的子集。本论文涵盖四个不同的研究工作，每个工作都有助于改善Web隐私和安全性的总体目标。首先，本文描述了一种自动技术，该技术通过在商品Web浏览器中检测DOM来测量Web在Web上的使用情况，使浏览器与网站进行交互以实现与人类用户使用的大多数功能相同的方式进行自动化，以及记录此执行过程中触发了什么功能。本节还介绍了在默认的浏览器配置以及安装了流行的阻止扩展程序的情况下，将此自动记录方法应用于整个Alexa 10k的结果。本文涵盖了四个不同的研究工作，每个工作都为改善网络隐私和安全性的总体目标做出了贡献。首先，本文描述了一种自动化技术，该技术通过在商品Web浏览器中检测DOM来测量Web在Web上的使用情况，使浏览器与网站进行交互以实现与人类用户所使用的大多数功能相同的方式进行自动化，以及记录此执行过程中触发了什么功能。本节还介绍了在默认浏览器配置和安装了流行的阻止扩展程序的情况下，将此自动记录方法应用于整个Alexa 10k的结果。最后，本文介绍了用于设计Web应用程序的替代系统，该系统提供了客户端强制的隐私和安全保证。该系统的设计基于先前讨论的按标准的成本效益方法来确定网站通常需要哪些Web API功能。每一项工作都支持一个总体发现，即仅需很小的一部分就可以改善Web上的隐私和安全性。用户体验的成本。与当前使每个站点都可以访问浏览器的每个功能（仅有少数例外）的做法相反，这项工作提出了一种数据驱动的方法，用于将网站限制为一部分更安全的用户服务功能。本文进一步表明，对Web API实施这种“最低特权”方法所带来的隐私和安全益处将是有意义的，并且这些技术的实际部署表明，至少某些Web用户发现该方法可用于保护其隐私和安全。 。

著录项

  • 作者

    Snyder, Peter.;

  • 作者单位

    University of Illinois at Chicago.;

  • 授予单位 University of Illinois at Chicago.;
  • 学科 Computer science.
  • 学位 Ph.D.
  • 年度 2018
  • 页码 157 p.
  • 总页数 157
  • 原文格式 PDF
  • 正文语种 eng
  • 中图分类 遥感技术;
  • 关键词

  • 入库时间 2022-08-17 11:53:11

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号