# AV-Teller: Browser Fingerprinting for Client-Side Security Software Identification
## 6 Results  
This section reports the results of evaluating antivirus detection mechanisms within the AV-Teller Framework, utilizing the evaluation setup detailed in Section 5. The assessments encompassed three detection scenarios: DOM Monitoring-Based Detection, Signature-Based Detection, and Phishing Page-Based Detection. The findings demonstrated varying levels of efficacy across the evaluated antivirus solutions. The evaluation outcomes were categorized into three distinct classes: Antivirus Identification, Protected Anonymous, and Antivirus Undetected. Antivirus Identification denotes instances where the antivirus successfully executes its protective function--such as threat blocking or system activity indicative of antivirus operations--yet inadvertently discloses identifiable information that adversaries could exploit. Protected Anonymous represents the optimal outcome, wherein the antivirus effectively mitigates threats or interacts with the system while maintaining anonymity, thereby minimizing exposure to targeted attacks. Antivirus Undetected corresponds to scenarios where no discernible antivirus activity was observed, rendering the system unprotected and vulnerable against potential threats. Table 2 provides a comprehensive summary of these categories, including their definitions, percentages, and the number of antivirus products observed within each group. The evaluation revealed that 32% (9 products) of the tested antivirus were categorized under Antivirus Identification, 11% (3 products) achieved Protected Anonymous, and 57% (16 products) fell into the Antivirus Undetected category. While Antivirus Identification indicates the capacity to block threats, it remains insufficient due to the exposure of the antivirus system to potential exploitation. The Antivirus Undetected outcomes category presents the greatest concern, leaving users entirely vulnerable to threats and emphasizing critical system vulnerabilities. Conversely, Protected Anonymous represents an optimal balance, combining effective threat mitigation with anonymity, which is crucial for preventing attackers from leveraging antivirus-specific weaknesses. Table 3 provides further insights into the individual performance of antivirus products across three detection methods: Sc. 1 DOM Monitoring-Based Detection, Sc. 2 Signature-Based Detection, and Sc. 3 Phishing Page-Based Detection, offering a comprehensive view of their detection capabilities. These findings underscore the varied efficacy of antivirus solution across distinct detection methodologies. To ensure the reliability of our results, each experiment was conducted 100 times per antivirus product across all three scenarios, producing consistent detection outcomes with negligible variance. Additionally, the experiments also included executions within a non-antivirus (AV) baseline environment to verify that detection artifacts--such as DOM modifications, signature alerts, or phishing blocks--did not originate from browser behavior alone. This confirms that all observed effects stemmed from antivirus-specific responses. Antivirus products were classified based on their responses across the three scenarios. Products exhibiting an \"**O**\" (Antivirus Identification) in any scenario were categorized as Antivirus Identification, whereas products demonstrating a \"**A**\" (Protected Anonymous) in any scenario were classified as Protected Anonymous. Since detection in even a single scenario reflects behavior corresponding to the respective classification, this hierarchical approach prioritizes the most significant behavior--either identification or anonymous protection--in the final categorization. To further illustrate the overall detection patterns across the three AV-Teller scenarios a summary chart is presented in Figure 7.