# AV-Teller: Browser Fingerprinting for Client-Side Security Software Identification
## 4 Implementation of the AV-Teller Framework
### Design of the AV-Teller Framework  
Figure 6 illustrates an overview of the framework, detailing interactions among core modules and the associated data flow. To enhance comprehensibility, Table 1 summarizes the development environment and toolset utilized in implementing the AV-Teller framework, establishing the technological foundation essential for its architecture and evaluation.  
The subsequent sections outline the designed and implementation of these components within the specified environment:  
* Reasoning Module: Initializes the process by accepting user input and analyzing antivirus detection results from the Analyze Server. It determines a new experimental trajectory, communicates it to the Snapshot Checker, and iterates the process.
* Snapshot Checker: Retrieves snapshot data from the Snapshot Repository and transmits it to the Comparison Module along the specified analytical pathway.
* Comparison Module: Evaluates received data against existing snapshots in the repository. If no correlation is detected, it queries the Environment DB to construct a new snapshot.
* Environment DB: Stores configurations parameters for antivirus software, web browsers, and experimental environments. It provides essential elements for the Testing Environment Generator.
* Testing Environment Generator: Constructs new system snapshots utilizing elements from the Environment DB, which are subsequently stored in the Snapshot Repository.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Category** & **Details** \\ \hline Development Environment & Windows 11 on Intel Core 91-14900k, 64 GB RAM \\ Programming Languages & Python (v3.10), PowerShell (v5.1), JavaScript (ES2024), HTML (HTML5) \\ Libraries/Frameworks & MutationObserver API, Hyper-V API, Flask, Selenium \\ Testing Platform & Hyper-V on Windows 10 with Google Chrome (v131.0), Firefox (v132.0), Microsoft Edge (v131.0) \\ Database & SQLite (v3.47.1) \\ Tools/IDEs & Visual Studio Code (v1.85), Git (v2.44.0) \\ Experiment Configuration & Default antivirus settings, browser without extensions \\ \hline \hline \end{tabular}
\end{table}
Table 1: Development environment and tools for AV-Teller framework.  
Figure 6: An overview of the architecture for AV-Teller Framework.  
* Snapshot Repository: Maintains snapshots with unique configurations of antivirus software and web browsers, enabling their retrieval for the Snapshot Checker when required.
* System Virtualizer: Facilitates the virtualization of system environments through snapshots from the repository.
* Virtual System: Executes experimental procedures by interfacing with the Profile Server via a web browser configured with various environmental settings
* Profile Server: Emulates test scenarios, sourced from the Experiment DB, through its web server while interacting with the browser of the virtual system during experimentation.
* Collector: Collects data on system states and experimental results, transmitting them to the Analyze Server for further processing.
* Analyze Server: Processes experimental data to derive detection outcomes and performance metrics, subsequently relaying results to the Reasoning Module.