I am right now working on a problem and looking for some papers / information about spyware, tracking and cookie problems. I am no expert in that area, so I lack the knowledge where to find material (papers, master thesis, specific blogs,conference material etc) about that kind of problems.

I'm not looking for trivial explanation or definitions (wiki), but kinda more a scientific approach.


Here are some papers that I enjoyed and think are worth reading:

Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning, by Mika Ayenson, Dietrich James Wambach, Ashkan Soltani, Nathan Good, and Chris Jay Hoofnagle. 2011.

Flash Cookies and Privacy, by Ashkan Soltani, Shannon Canty, Quentin Mayo, Lauren Thomas, and Chris Jay Hoofnagle. August 2009.

A Crawler-based Study of Spyware on the Web, by Alexander Moshchuk, Tanya Bragin, Steven D. Gribble, and Henry M. Levy. Proceedings of the 13th Annual Network and Distributed Systems Security Symposium (NDSS 2006), San Diego, CA, February 2006.

Behavior-based Spyware Detection, by Engin Kirda, Christopher KruegelGreg Banks, Giovanni Vigna, and Richard Kemmerer. 15th Usenix Security Symposium, August 2006.

An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications, by Dongseok Jang, Ranjit Jhala, Sorin Lerner, and Hovav Shacham. CCS 2010.

SpyProxy: Execution-based Detection of Malicious Web Content, by Alexander Moshchuk, Tanya Bragin, Damien Deville, Steven D. Gribble, and Henry M. Levy. Proceedings of the 16th USENIX Security Symposium (USENIX Security 2007), Boston, MA, August 2007.

Measurement and Analysis of Spyware in a University Environment, by Stefan Saroiu, Steven D. Gribble, and Henry M. Levy. Proceedings of the First Symposium on Networked Systems Design and Implementation (NSDI '04), San Francisco, California, March 2004.

Automated Spyware Collection and Analysis, by Andreas Stamminger, Christopher Kruegel, Giovanni Vigna, and Engin Kirda. 12th Information Security Conference (ISC), Lecture Notes in Computer Science, Springer Verlag, Italy, September 2009.

Dynamic Spyware Analysis, by Manuel Egele, Christopher Kruegel, Engin Kirda, Heng Yin, and Dawn Song. Usenix Annual Technical Conference, USA, June 2007.

Do Not Track: http://donottrack.us/.

An Analysis of Private Browsing Modes in Modern Browsers, by Gaurav Aggarwal, Elie Bursztein, Dan Boneh, and Collin Jackson. USENIX Security 2010.

Fingerprinting Information in JavaScript Implementations, by Keaton Mowery, Dillon Bogenreif, Scott Yilek, and Hovav Shacham. W2SP 2011.

Timing Attacks on Web Privacy, by Edward W. Felten and Michael A. Schneider. Proc. of 7th ACM Conference on Computer and Communications Security, Nov. 2000.

RequestPolicy: Increasing Web Browsing Privacy through Control of Cross-Site Requests, by Justin Samuel and Beichuan Zhang. PETS 2009.

What Californians Understand about Privacy Online, by Chris Jay Hoofnagle and Jennifer King. September 2008.

Americans Reject Tailored Advertising and Three Activities that Enable It, by Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy Bleakley, Michael Hennessy. September 2009.

Cookies and Web Browser Design: Toward Realizing Informed Consent Online, by Lynette I. Millett, Batya Friedman, and Edward W. Felten. Proc. of CHI 2001 Conference on Human Factors in Computing Systems, April 2001.

Informed Consent in the Mozilla Browser: Implementing Value-Sensitive Design, by Batya Friedman, Daniel C. Howe, and Edward W. Felten. Proc. of 35th Annual Hawaii International Conference on System Sciences, January 2002.

Adnostic: Privacy-Preserving Targeted Advertising, by Vincent Toubiana, Arvind Narayanan, Dan Boneh, Helen Nissenbaum, Solon Barocas. NDSS 2010.

I Still Know What You Visited Last Summer: Leaking browsing history via user interaction and side channel attacks, by Zack Weinberg, Eric Chen, Pavithra Ramesh Jayaraman, and Collin Jackson. IEEE Security and Privacy Symposium 2011.

This should be enough to get you started. I recommend using standard literature search methods. For instance, read the related work sections of these papers to see if they identify/cite other papers worth reading. Then, plug each paper into Google Scholar to find what newer papers cite them, and see if any of those are interesting. Keep expanding your pool in this way. If there are any researchers who have written multiple papers you really liked, check out all of their publications. Look at the proceedings of PETS, WEIS, and SOUPS, as they may have more that is of interest to you.

P.S. I also want to point you to an excellent blog by a leading researcher that you might enjoy, 33bits.org. Check out especially these topics on that blog: ubercookies, history stealing, tracking.

  • well, that looks like i have some work ahead :). Big thx. – Gero Mar 3 '12 at 21:42

The standard places to look for computer science related research are

(and the references section on Wikipedia articles)

You may want to do the searches from the network of your University because some of those libraries use IP based filters to only allow access to the actual papers to customers and most universities are customers of one or more publishers.

  • thx for the listing. Its a good start although i had all sites but DBLP. I would be happy if i could come up with a more specific (malware, spyware) source. – Gero Mar 1 '12 at 14:31
  • CiteSeerX as well. – logicalscope Mar 1 '12 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.