Dazzle-attack: Supplementary Materials 

Reliability of Dazzle-attack (Understanding the success rate of Dazzle-attack): 3 experiments

We conduct 3 experiments to show the reliability of Dazzle-attack instance. Specifically, we profile the following 5 websites for 20 days (from 2019-05-07 ~ 2019-05-27). Selected DOM elements and attack triggering keywords are noted as well.

Experiment 1

The below 2 figures show how the attack triggering keywords are appearing during the profiling and simulation periods. In short, during the profiling period, it triggers once in 20 days (5/18/2019 ~ 6/17/2019). During the simulation period (20 days as well), it also shows up only once. This would be a typical configuration of Dazzle-attack that triggers an attack occasionally while maintaining its reliability. Moreover, we do not observe changes of DOM structures for all the websites and DOM elements chosen in this experiment.

Data from Profiling Period (5/7/2019 ~ 5/27/2019)
(Redline indicates when all the keywords from 5 websites are appearing together)

Data from Simulation Period (5/28/2019 ~ 6/17/2019)
(Redline indicates when all the keywords from 5 websites are appearing together)

Experiment 2

We profile the following 5 websites for 20 days (from 2019-05-07 ~ 2019-05-27). Selected DOM elements and attack triggering keywords are noted as well.

The below 2 figures show how the attack triggering keywords are appearing during the profiling and simulation periods. In short, during the profiling period, it triggers once in 20 days (5/18/2019 ~ 6/17/2019). During the simulation period (20 days as well), it also shows up only once. This would be a typical configuration of Dazzle-attack that triggers an attack occasionally while maintaining its reliability. Moreover, we do not observe changes of DOM structures for all the websites and DOM elements chosen in this experiment.

Data from Profiling Period (5/7/2019 ~ 5/27/2019)
(Redline indicates when all the keywords from 5 websites are appearing together)

Data from Simulation Period (5/28/2019 ~ 6/17/2019)
(Redline indicates when all the keywords from 5 websites are appearing together)

Experiment 3

We profile the following 5 websites for 20 days (from 2019-05-07 ~ 2019-05-27). Selected DOM elements and attack triggering keywords are noted as well.

The below 2 figures show how the attack triggering keywords are appearing during the profiling and simulation periods. In short, during the profiling period, it triggers once in 20 days (5/18/2019 ~ 6/17/2019). During the simulation period (20 days as well), it also shows up only once. This would be a typical configuration of Dazzle-attack that triggers an attack occasionally while maintaining its reliability. Moreover, we do not observe changes of DOM structures for all the websites and DOM elements chosen in this experiment.

Data from Profiling Period (5/7/2019 ~ 5/27/2019)
(Redline indicates when all the keywords from 5 websites are appearing together)

Data from Simulation Period (5/28/2019 ~ 6/17/2019)
(Redline indicates when all the keywords from 5 websites are appearing together)

Calculating the divider G

As for ‘Distribution’, it means that the divider is G, 2G, 4G,8G, and 16G for iterations, respectively. Different sizes of buckets are used to handle different sizes of contents. To help understand, we add pseudo code as following. We will add and clarify this on the paper.

All definitions of terms are the same as shown in the paper. In this paper, R = 5 is used (line 13). Whenever the content of input words is appeared in a group (Grpg), distribution value, pntg is getting bigger (line 23). Note that the size of each group changes every iteration by change of G (line 24) so that it takes into account different size of input words. That is, it considers various size of group and takes average of summation of distribution values. The big pntf means that input words are distributed evenly (line 25).