# AV-Teller: Browser Fingerprinting for Client-Side Security Software Identification
## 3 Strategies and Tactics for Profiling Antivirus Behavior
### Antivirus Profiling Scenarios
#### 3.2.1 Scenario 1: DOM Monitoring-Based Detection  
The Document Object Model (DOM) is a standardized hierarchical representation of web page content and structure, encompassing HTML elements (e.g., div, p, and span), attributes, and event handlers. It serves as the primary interface for interactions between the web browser and user, positioning the DOM as a critical target for antivirus solutions aiming to detect and mitigate suspicious elements. Antivirus software often modifies the DOM by altering its structure or injecting additional elements to identify and neutralize malicious code. For instance, common actions include inserting security alert banners or removing specific nodes in the DOM to block harmful scripts, providing insights into the interplay between browsers and antivirus software. Scenario 1 employs the Web API MutationObserver for real-time monitoring of DOM modifications, including element addition/removal, attribute value alterations, and text content updates. By observing these changes, Scenario 1 identifies antivirus characteristics through real-time tracking of DOM modifications.  
Figure 2 illustrates the functionality of the MutationObserver API for real-time monitoring of changes to the DOM structure. The diagram depicts the hierarchical structure of the DOM, where black lines denote parent-child relationships between elements, such as HTML, body, and img. These connections represent the document structure, linking parent nodes to their corresponding child nodes. Arrows within the diagram categorize distinct types of DOM alterations: blue arrows represent additions (e.g., the insertion of new elements into the DOM), red arrows signify deletions (e.g., the removal of elements or nodes), and green arrows indicate modifications (e.g., updates to text content or attribute values). The red box highlights interactions initiated by antivirus software within the DOM, such as the addition of security-related elements (e.g., banners or warning messages) aimed at mitigating potential threats. The MutationObserver captures these interactions, enabling comprehensive analysis of antivirus-induced modifications and their behavioral implications. This approach facilitates the identification of antivirus activities and their real-time impact on the DOM structure.  
To validate the source of DOM modifications, we analyzed their consistency across multiple test environments. These changes--such as injected warning elements, vendor-specific script tags, and uniquely styled DOM nodes--were consistently replicated in successive test runs and exhibited behavior specific to individual antivirus solutions. Although we did not conduct a dedicated control experiment with isolated browser extensions due to time constraints, we confirmed that such mutations did not appear in clean envi  
Figure 1: Conceptual summary of antivirus profiling approaches.  
ronments or when common extensions were enabled. These results strongly indicate that the observed modifications originated from antivirus interventions rather than regular browser behavior.