OpenRaiser/Intern-Atlas huggingface dataset:
The Double Edged Sword: Identifying Authentication Pages and their Fingerprinting Behavior
Authors: Asuman Senol, Alisha Ukani, Dylan Cutler, Igor Bilogrevic
Venue: WWW
Year: 2024

Browser fingerprinting is often associated with cross-site user tracking, a practice that many browsers (e.g., Safari, Brave, Edge, Firefox, and Chrome) want to block. However, less is publicly known about its uses to enhance online safety, where it can provide an additional security layer against service abuses (e.g., in combination with CAPTCHAs) or during user authentication. To the best of our knowledge, no fingerprinting defenses deployed thus far consider this important distinction when blocking fingerprinting attempts, so they might negatively affect website functionality and security. To address this issue we make three main contributions. First, we introduce a novel machine learning-based method to automatically identify authentication pages (i.e. login and sign-up pages). Our supervised algorithm achieves 96-98% precision and recall on a manually-labelled dataset of almost 1,000 popular sites. Second, we compare our algorithm with methods from prior works on the same dataset, showing that it significantly outperforms all of them. Third, we quantify the prevalence of fingerprinting scripts across login and sign-up pages (10.2%) versus those executed on other pages (9.2%); while the rates of fingerprinting are similar, home pages and authentication pages differ in the third-party scripts they include and how often these scripts are labeled as tracking. We also highlight the substantial differences in fingerprinting on login and sign-up pages. Our work sheds light on the complicated reality that fingerprinting is used to both protect user security and invade user privacy; this dual nature must be considered by fingerprinting mitigations.
Improving Item-side Fairness of Multimodal Recommendation via Modality Debiasing
Authors: Yu Shang, Chen Gao, Jiansheng Chen, Depeng Jin, Yong Li
Venue: WWW
Year: 2024

Multimodal recommender systems have acquired applications in broad web scenarios such as e-commerce businesses and short-video platforms. Existing multimodal recommendation methods generally boost performance by introducing item-side multimodal content as supplement information. However, the common training paradigm, i.e., encoding unimodal content respectively and fusing them to fit user preference scores, makes the model biased towards items with prevailing modality content under non-uniform training data. This results in a serious item-side unfairness issue, i.e., some items with prevailing modality content are over-recommended while a large number of items don't receive adequate recommendation opportunities, leaving corresponding content providers at great disadvantage. Aiming to eliminate such modality bias and promote item-side fairness, we propose a fairness-aware modality debiasing framework based on counterfactual inference. In the training stage, we additionally introduce unimodal prediction branches to capture the modality bias. In the inference stage, we conduct a fairness-aware counterfactual inference to adaptively eliminate the modality bias. The proposed framework is model-agnostic and flexible to be implemented in various multimodal recommendation models. Extensive experiments on two datasets demonstrate that the proposed method can significantly enhance item-side fairness while providing competitive recommendation accuracy. Our proposed framework is expected to help mitigate the unfair treatment experienced by vulnerable content providers on multimedia web platforms. Codes are available in https://github.com/tsinghua-fib-lab-WWW2024-Modality-Debiasing.
The Invisible Game on the Internet: A Case Study of Decoding Deceptive Patterns
Authors: Zewei Shi, Ruoxi Sun, Jieshan Chen, Jiamou Sun, Minhui Xue
Venue: WWW
Year: 2024

Deceptive patterns are design practices embedded in digital platforms to manipulate users, representing a widespread and long-standing issue in the web and mobile software development industry. Legislative actions highlight the urgency of globally regulating deceptive patterns. However, despite advancements in detection tools, a significant gap exists in assessing deceptive pattern risks. In this study, we introduce a comprehensive approach involving the interactions between the Adversary, Watchdog (e.g., detection tools), and Challengers (e.g., users) to formalize and decode deceptive pattern threats. Based on this, we propose a quantitative risk assessment system. Representative cases are analyzed to showcase the practicability of the proposed risk scoring system, emphasizing the importance of involving human factors in deceptive pattern risk assessment.
Towards Reliable and Efficient Long-Term Recommendation with Large Foundation Models
Authors: Wentao Shi
Venue: WWW
Year: 2024

Prioritizing long-term engagement rather than immediate benefits has garnered increasing attention in recent years. However, current research on long-term recommendation faces substantial challenges in terms of model evaluation and design: 1) Traditional evaluation approaches suffer from limitations due to the sparsity and bias in the offline data and fail to capture user psychological influences. 2) Existing recommenders based on Reinforcement Learning (RL) are entirely data-driven and constrained by sparse and long-tail distributed offline data. Fortunately, recent advancements in Large Foundation Models (LFMs), characterized by remarkable simulation and planning capacity, offer significant opportunities for long-term recommendation. Despite potential, due to the substantial scenario divergence between LFM pre-training and recommendation, employing LFMs in long-term recommendation still faces certain challenges. To this end, this research focuses on adapting the remarkable capabilities of LFMs to long-term recommendations to devise reliable evaluation schemes and efficient recommenders.
Deanonymizing Transactions Originating from Monero Tor Hidden Service Nodes
Authors: Ruisheng Shi, Yulian Ge, Lina Lan, Zhiyuan Peng, Shenwen Lin, Lin Li
Venue: WWW
Year: 2024

Monero is a privacy-focused cryptocurrency that incorporates anonymity networks (such as Tor and I2P) and deploys the Dandelion++ protocol to prevent malicious attackers from linking transactions with their source IPs. However, this paper highlights a vulnerability in Monero's integration of the Tor network, which allows an attacker to successfully deanonymize transactions originating from Monero Tor hidden service nodes at the network-layer level. Our approach involves injecting malicious Monero Tor hidden service nodes into the Monero P2P network to correlate the onion addresses of incoming Monero Tor hidden service peers with their originating transactions. And by sending a signal watermark embedded with the onion address to the Tor circuit, we establish a correlation between the onion address and IP address of a Monero Tor hidden service node. Ultimately, we correlate transactions and IPs of Monero Tor hidden service nodes. Through experimentation on the Monero testnet, we provide empirical evidence of the effectiveness of our approach in successfully deanonymizing transactions originating from Monero Tor hidden service nodes.
An Identity Alignment Method based on Online Tracking
Authors: Ruisheng Shi, Zhiyuan Peng, Tong Fu, Lina Lan, Jiaqi Zeng, Yuyang Shi, Jinqiao Shi, Shenwen Lin, Lin Li
Venue: WWW
Year: 2024

Companies track user data and sell it to advertisers. They claim to protect user privacy by anonymization, but our research shows that significant risks are still involved. Even with anonymous data, attackers can identify users on other websites from tracking records. We propose an identity alignment method of deanonymization attack, which analyzes tracker data to align identities. We explore the key factors affecting the effectiveness of identity alignment and analyze its impact on user privacy. We use crawling data to create tracker data close to ground-truth scenarios and propose an evaluation framework for online tracking based identity alignment.
Over-Sampling Strategy in Feature Space for Graphs based Class-imbalanced Bot Detection
Authors: Shuhao Shi, Kai Qiao, Chen Chen, Jie Yang, Jian Chen, Bin Yan
Venue: WWW
Year: 2024

The presence of a large number of bots in Online Social Networks (OSN) leads to undesirable social effects. Graph neural networks (GNNs) are effective in detecting bots as they utilize user interactions. However, class-imbalanced issues can affect bot detection performance. To address this, we propose an over-sampling strategy for GNNs (OS-GNN) that generates samples for the minority class without edge synthesis. First, node features are mapped to a feature space through neighborhood aggregation. Then, we generate samples for the minority class in the feature space. Finally, the augmented features are used to train the classifiers. This framework is general and can be easily extended into different GNN architectures. The proposed framework is evaluated using three real-world bot detection benchmark datasets, and it consistently exhibits superiority over the baselines.
RecurScan: Detecting Recurring Vulnerabilities in PHP Web Applications
Authors: Youkun Shi, Yuan Zhang, Tianhao Bai, Lei Zhang, Xin Tan, Min Yang
Venue: WWW
Year: 2024

Detecting recurring vulnerabilities has become a popular means of static vulnerability detection in recent years because they do not require labor-intensive vulnerability modeling. Recently, a body of work, with HiddenCPG as a representative, has redefined the problem of statically identifying recurring vulnerabilities as the subgraph isomorphism problem. More specifically, these approaches represent known vulnerable code as graph-based structures (e.g., PDG or CPG), and then identify subgraphs within target applications that match the vulnerable graphs. However, since these methods are highly sensitive to changes in the code graph, they may miss a significant number of recurring vulnerabilities with slight code differences from known vulnerabilities. In this paper, we propose a novel approach, namely RecurScan, which can accurately detect recurring vulnerabilities with resilience to code differences. To achieve this goal, RecurScan works around security patches and symbolic tracking techniques, detecting recurring vulnerabilities by comparing symbolic expressions and selective constraints between the target applications and known vulnerabilities. Benefiting from this design, RecurScan can tolerate the code differences arising from complex data or control flows within the applications. We evaluated RecurScan on 200 popular PHP web applications using 184 known vulnerability patches. The results demonstrate that RecurScan discovered 232 previously unknown vulnerabilities, 174 of which were assigned CVE identifiers, outperforming state-of-the-art approach (i.e., HiddenCPG) by 25.98% in precision and 87.09% in recall.
Data Augmentation for Smishing Detection: A Theory-based Prompt Engineering Approach
Authors: Ho Sung Shim, Hyoungjun Park, Kyuhan Lee, Jang-Sun Park, Seonhye Kang
Venue: WWW
Year: 2024

Smishing, which refers to social engineering attacks delivered through mobile devices such as smartphones, poses significant threats, yet limited data hinder the development of effective countermeasures. To tackle this, we propose a novel prompt engineering method for data augmentation in smishing detection. Distinguished by its utilization of insights from social science on smishing mechanisms, our approach offers a promising avenue for improving machine learning models in combating smishing attacks.
A Case Study Comparing Twitter Communities Detected by the Louvain and Leiden Algorithms During the 2022 War in Ukraine
Authors: Karolina Sliwa, Ema Kusen, Mark Strembeck
Venue: WWW
Year: 2024

This paper presents a case study regarding a comparative examination of the Louvain and Leiden community detection algorithms. The case study was conducted on a real-world communication network consisting of 3,222,623 nodes and 27,423,553 edges. In particular, the network in our case study models the communication between Twitter users during the initial four weeks of the 2022 war in Ukraine. In addition, we also applied dynamic topic modeling in order to examine differences in the detected communities.
A Study of GDPR Compliance under the Transparency and Consent Framework
Authors: Michael Smith, Antonio Torres-Agüero, Riley Grossman, Pritam Sen, Yi Chen, Cristian Borcea
Venue: WWW
Year: 2024

This paper presents a study of GDPR compliance under the Interactive Advertising Bureau Europe's Transparency and Consent Framework (TCF). This framework provides digital advertising market participants a standard for sharing users' privacy consent choices. TCF is widely used across the Internet, and this paper presents a thorough experimental evaluation of both the compliance of websites with TCF and its impact on user privacy. We reviewed 2,230 websites that use TCF and accepted the automatic decline of user consent by our data collection system. Unlike previous work on GDPR compliance, we found that most websites using TCF properly record the user's consent choice. However, we found that 72.8% of the websites that were TCF compliant claimed legitimate interest as a rationale for overriding the consent choice. While legitimate interest is legal under GDPR, previous studies have shown that most users disagreed with how it is being used to collect data. Additionally, analysis of cookies set to the browsers indicates that TCF may not fully protect user privacy even when websites are compliant. Our research provides regulators and publishers with a data collection and analysis system to monitor compliance, detect non-compliance, and examine questionable practices of circumventing user consent choices using legitimate interest.
GAMMA: Graph Neural Network-Based Multi-Bottleneck Localization for Microservices Applications
Authors: Gagan Somashekar, Anurag Dutt, Mainak Adak, Tania Lorido-Botran, Anshul Gandhi
Venue: WWW
Year: 2024

Microservices architecture is quickly replacing monolithic and multi-tier architectures as the implementation choice for large-scale web applications as it allows independent development, scalability, and maintenance. However, even with careful node scheduling and scaling, the microservices applications are still vulnerable to performance degradation due to unexpected (dependent or independent) events like anomalous node behavior, workload interference, or sudden spikes in requests or retries. These events can adversely affect the performance of one or more microservices (bottlenecks), degrading the overall application performance. To ensure a good customer experience and avoid revenue loss, it is crucial to detect and mitigate all bottlenecks swiftly. This work introduces GAMMA, a novel, explainable graph learning model that integrates a mixture of experts to detect multiple bottlenecks. We evaluated GAMMA using a popular open-source benchmarking application deployed on Kubernetes under various practical bottleneck scenarios. Our experimental evaluation results show that GAMMA provides significantly better performance (46% higher F1 score) than existing works that employ deep learning, machine learning, and statistical techniques, demonstrating its ability to detect multiple bottlenecks by learning complex interactions in a microservices architecture. The dataset is made publicly available [49] for reproducibility and further research in the field.
SigBart: Enhanced Pre-training via Salient Content Representation Learning for Social Media Summarization
Authors: Sajad Sotudeh, Nazli Goharian
Venue: WWW
Year: 2024

Our approach to automatically summarizing online mental health posts could help counselors by reducing their reading time, enabling quicker and more effective support for individuals seeking mental health assistance. Neural text summarization methods demonstrate promising performance owing to their strong pre-training procedure. Random token/span masking technique is often relied upon by existing pre-trained language models; an approach that overlooks the importance of content when learning word representations. In an attempt to rectify this, we propose using source and summary alignments as a saliency signal to enhance the pre-training strategy of language model for better representation learning of important content, paving the way for a positive impact on the model fine-tuning phase. Our experiments on a mental health-related dataset for user post summarization MentSum reveal improved performance, as evidenced by human evaluation metrics, surpassing the current state-of-the-art system.
Data Augmentation for Conversational AI
Authors: Heydar Soudani, Roxana Petcu, Evangelos Kanoulas, Faegheh Hasibi
Venue: WWW
Year: 2024

Advancements in conversational systems have revolutionized information access, surpassing the limitations of single queries. However, developing dialogue systems requires a large amount of training data, which is a challenge in low-resource domains and languages. Traditional data collection methods like crowd-sourcing are labor-intensive and time-consuming, making them ineffective in this context. Data augmentation (DA) is an affective approach to alleviate the data scarcity problem in conversational systems. This tutorial provides a comprehensive and up-to-date overview of DA approaches in the context of conversational systems. It highlights recent advances in open domain and task-oriented conversation generation, and different paradigms of evaluating these models. We also discuss current challenges and future directions in order to help researchers and practitioners to further advance the field in this area.
14th Temporal Web Analytics Workshop (TempWeb)
Authors: Marc Spaniol, Omar Alonso, Ricardo Baeza-Yates
Venue: WWW
Year: 2024

The TempWeb workshop series is an established co-located event at The Web Conference that aims at bringing together researchers and practitioners across various domains. Naturally, submissions address core fields of studies in computer science and aspects such as temporal IE/IR, Web mining, Web archiving and large scale data analysis to just name a few. Aiming at the investigation of infrastructures, scalable methods, and innovative software for aggregating, querying, and analyzing heterogeneous data at Web scale, TempWeb has developed as a forum for a community from science and industry. However, TempWeb's sweet spot is its close link to application domains such as the social sciences, marketing, economics, etc. Thus, the workshop continuously attracts not only technical innovations, but also studies on the societal implications of digital media usage along the temporal dimension. To this end, TempWeb can be considered a melting pot of interdisciplinary research. Frequent contributors and emerging collaborations show the advantages of collaborations triggered by the workshop participation. In its 2024 edition, topics of TempWeb again cover a wide spectrum of topics on Web related research ranging from studies of control control, via terminological studies, up to community analysis and content recommendation.
Bi-CAT: Improving Robustness of LLM-based Text Rankers to Conditional Distribution Shifts
Authors: Sriram Srinivasan, Stephen Sheng, Rishabh Deshmukh, Chen Luo, Yesh Dattatreya, Subhajit Sanyal, S. V. N. Vishwanathan
Venue: WWW
Year: 2024

Retrieval and ranking lie at the heart of several applications like search, question-answering, and recommendations. The use of Large language models (LLMs) such as BERT in these applications have shown promising results in recent times. Recent works on text-based retrievers and rankers show promising results by using bi-encoders (BE) architecture with BERT like LLMs for retrieval and a cross-attention transformer (CAT) architecture BERT or other LLMs for ranking the results retrieved. Although the use of CAT architecture for re-ranking improves ranking metrics, their robustness to data shifts is not guaranteed. In this work we analyze the robustness of CAT-based rankers. Specifically, we show that CAT rankers are sensitive to item distribution shifts conditioned on a query, we refer to this as conditional item distribution shift (CIDS). CIDS naturally occurs in large online search systems as the retrievers keep evolving, making it challenging to consistently train and evaluate rankers with the same item distribution. In this paper, we formally define CIDS and show that while CAT rankers are sensitive to this, BE models are far more robust to CIDS. We propose a simple yet effective approach referred to as BI-CAT which augments BE model outputs with CAT rankers, to significantly improve the robustness of CAT rankers without any drop in in-distribution performance. We conducted a series of experiments on two publicly available ranking datasets and one dataset from a large e-commerce store. Our results on dataset with CIDS demonstrate that the BI-CAT model significantly improves the robustness of CAT rankers by roughly 100-1000bps in F1 without any reduction in in-distribution model performance.
Toward Making Opaque Web Content More Accessible: Accessibility From Adobe Flash to Canvas-Rendered Apps
Authors: Thomas Steiner
Venue: WWW
Year: 2024

Adobe Flash, once a ubiquitous multimedia platform, played a pivotal role in shaping the digital landscape for nearly two decades. Its capabilities ranged from animated banners and immersive websites to complex online applications and games. Flash content was embedded on websites with the embed or the object element. To the browser, the embedded content is opaque by default, which means Flash content can't be used for the accessibility tree that the browser creates based on the DOM tree, which is used by platform-specific accessibility APIs to provide a representation that can be understood by assistive technologies, such as screen readers. With Flash losing out on popularity, HTML 5 introduced the canvas element, which for the first time allowed developers to draw graphics and animations with either the canvas scripting API or the WebGL API directly natively in the browser. Similar to Flash, such canvas-rendered content is opaque by default and unusable for the accessibility tree. Lastly, the implementation of the WebAssembly Garbage Collection (WasmGC) standard in browsers allowed developers to port applications, written in non-Web programming languages like Kotlin for non-Web platforms like Android, to the Web by compiling them to WasmGC and rendering the entire app into a canvas. In the most extreme of cases, this means that the entire HTML code of an application can consist of a sole canvas tag, which evidently is opaque to the browser and impossible to leverage for the accessibility tree. Without judging their quality, this paper focuses on documenting approaches then and now for making such opaque Web content more accessible to users of assistive technologies.