# AV-Teller: Browser Fingerprinting for Client-Side Security Software Identification
## 1 Introduction  
Web browsers are essential components of daily digital interactions, serving as critical interfaces for accessing online information and services. With Google Search facilitating over 80 billion monthly visits [1], adversaries leverage this high traffic to develop sophisticated techniques aimed at circumventing antivirus mechanisms and exploiting systemic vulnerabilities. Cyberattacks are becoming increasingly complex, with their methods evolving rapidly alongside technological advancements [2; 3; 4]. The exploitation of cloud infrastructure and zero-day vulnerabilities has surged in recent years, introducing unprecedented challenges for existing security frameworks [5; 6; 7]. Additionally, artificial intelligence (AI) technologies are enabling novel attack vectors, demanding equally advanced and adaptive countermeasures [8; 9; 10]. These developments necessitate more sophisticated offensive strategies, which in turn require increasingly complex and responsive defense mechanisms. The Advanced Persistent Threat (APT) is illustrative of this shift, targeting specific organizations or government entities through prolonged and highly tailored attack strategies [11; 12; 13; 14]. A significant objective of APTs is the identification of systems, particularly the detection of security software such as antivirus. The exposure of antivirus information via web browsers represents a critical vulnerability, as attackers can exploit this data without deploying sophisticated detection mechanisms. Specifically, antivirus information identified on the client side, such as product details or behavioral characteristics, can be transmitted externally and verified by third parties. While this capability facilitates legitimate evaluation purposes, it also introduces significant risks, including the potential for misuse by malicious actors. Such exposure exacerbates the risk of targeted attacks, enabling adversaries to develop tailored strategies to bypass antivirus defenses and exploit inherent vulnerabilities. Browser fingerprinting, a technique that analyzes unique browser attributes to deduce system configurations, has become a significant method for adversaries to detect antivirus software and devise targeted strategies to circumvent detection or exploit vulnerabilities [15; 16; 17]. Despite its prevalence, prior studies have not specifically addressed the exposure of antivirus-related information within browser environments. This research represents the first to bridge this gap by employing browser fingerprinting to profile antivirus systems and assess the security risks associated with such disclosures. These insights are essential for developing robust mitigation strategies. To address these challenges, we introduce AV-Teller, a novel framework that leverages advanced browser fingerprinting techniques to identify antivirus software within browser environments. AV-Teller systematically evaluates antivirus detection mechanisms and assesses associated vulnerabilities. By simulating diverse scenarios and gathering real-time data, the framework facilitates comprehensive analyses of antivirus performance, revealing exploitable weaknesses and offering strategic insights to strengthen security systems. The remainder of the study is structured as follows: Section 2 outlines the foundational concepts, including antivirus detection strategies, browser-antivirus interactions, DOM monitoring techniques, antivirus evaluation methods, and browser fingerprinting techniques. Section 3 details methodologies for profiling antivirus behavior, encompassing scenario construction and evaluation. Section 4 presents the AV-Teller framework, describing its architectural design and iterative validation process. Section 5 elaborates on the evaluation setup, focusing on design parameters and the testing environment. Section 6 provides an analysis of evaluation, examining antivirus detection capabilities across profiling scenarios.