http header analysis

This work addresses the growing privacy and security risks posed by AI-powered autonomous web agents that commonly bypass protective mechanisms such as robots.txt. To counter this, the authors propose a multi-layer fingerprinting approach that integrates network-level features (e.g., TLS/HTTP protocol characteristics) with browser interaction behaviors, enabling precise differentiation among AI agents, human users, and traditional web crawlers. The method introduces a deployable logging framework that achieves fine-grained, cross-layer attribution of mainstream AI agents for the first time, demonstrating strong evasion resistance and robustness. Experimental evaluation across six widely used agent frameworks shows a classification accuracy of 97%, effectively isolating distinct traffic types and establishing a novel paradigm for content protection on the web.

Current automated tools fail to accurately emulate realistic human-browser interactions, introducing systematic bias into browser fingerprinting research. To address this, we conducted a 10-week empirical study involving 30 real users, collecting browsing behavior data across 3,000 mainstream websites. Our analysis revealed that 45% of fingerprinting sites are missed by conventional crawlers—a previously undocumented gap. We further identified three novel fingerprinting vectors: those dependent on authenticated sessions, human-triggered interactions (e.g., mouse movements, focus events), and anti-bot evasion techniques. Building on these insights, we propose a privacy-preserving fingerprint detection framework based on federated learning. Evaluated on real-world telemetry data, our method achieves a 22% improvement in detection accuracy over baselines. This demonstrates the critical role of authentic interaction data in enhancing detection robustness. Our work provides foundational empirical evidence for understanding modern fingerprinting mechanisms and advancing privacy-enhancing technologies.

Existing website fingerprinting (WFP) methods exhibit poor generalization in modern web environments—particularly single-page applications (SPAs)—largely because script-based traffic replay fails to capture the diversity and continuity of real user behavior. Method: We propose a novel, continuous traffic synthesis paradigm powered by multi-agent large language models (LLMs). Departing from page-boundary constraints, our approach employs a role-driven, collaborative multi-agent system that simulates personalized, semantically rich, and temporally coherent browsing behaviors to generate high-fidelity encrypted network traffic. Contribution/Results: This paradigm drastically reduces data synthesis cost and enhances scalability. Evaluations across 20 modern websites and traffic from 30 real users show that WFP models trained on LLM-synthesized data achieve >80% accuracy—surpassing <10% accuracy attained with script-generated data. Results demonstrate that modeling behavioral continuity and user persona is critical for improving WFP generalization.

This work exposes a critical threat to collaborative robot privacy: encrypted communication remains vulnerable to fine-grained motion recovery via traffic analysis. Existing website fingerprinting techniques (e.g., Tik-Tok, RF) fail to model intricate inter-action temporal dependencies, limiting their ability to infer high-level motion behaviors from scripted control interfaces. To address this, we pioneer the application of signal processing to robot traffic classification, extracting time-frequency domain features that precisely characterize action dynamics; these features, combined with machine learning, enable highly accurate motion recognition—significantly outperforming baseline methods. Comprehensive evaluation reveals that mainstream defenses (e.g., packet padding, timing obfuscation) entail an inherent trade-off between practicality and privacy protection. Our study establishes the first empirical, fine-grained behavioral inference benchmark for robotic systems and demonstrates that encryption alone is insufficient to safeguard operational semantic privacy.

This study addresses the challenge of effectively distinguishing AI-powered browsing agents from human users, a task where existing detection mechanisms fall short. The authors construct honeypot websites to collect browser fingerprints and fine-grained behavioral data—including keystrokes, scrolling, and mouse interactions—from seven prominent AI agents and human participants performing typical web tasks. They propose FP-Agent, a multiclass classifier trained on this multimodal dataset, which leverages behavioral fingerprints to differentiate both between AI agents and humans and among distinct AI agent types. This work is the first to systematically demonstrate the critical role of behavioral fingerprints in AI agent identification, overcoming the limitations of approaches relying solely on traditional browser fingerprinting. Experimental results show that FP-Agent accurately identifies all seven AI agent categories, substantially outperforming mainstream anti-bot services such as Cloudflare, which detect only one type, thereby affirming the decisive value of behavioral fingerprints in AI agent detection.

This study addresses the challenge of effectively detecting and distinguishing large language model (LLM) web agents employing stealth and anti-detection techniques from genuine human users. By deploying honeypot websites integrated with multiple anti-scraping mechanisms—including robots.txt, CAPTCHA, proof-of-work challenges, and Cloudflare protections—and combining multi-layer fingerprinting across network, HTTP, and browser levels, the authors systematically evaluate behavioral characteristics of six prominent LLM agents. The research reveals, for the first time, that all tested agents can be clearly differentiated from both humans and each other through these multi-layer fingerprints. Notably, some agents successfully bypass all deployed anti-scraping measures, while their stealth strategies often prove counterproductive, inadvertently increasing detectability and thereby challenging prevailing assumptions about the efficacy of current anti-detection approaches.

This study addresses the growing prevalence of bot detection in browser automation, which leads to systematic sample loss in web security and privacy research. Through large-scale measurements across 10,000 websites (40,000 visits) under four browser configurations, this work constructs a taxonomy of bot detection mechanisms and reveals that 82% of access denials are attributable to such detection, with Cloudflare and Akamai accounting for 37% and 26%, respectively. The authors propose a conditional-dependence-based inference method to uncover undeclared detection behaviors, combining custom instrumentation, header spoofing, and cross-configuration comparison. Their analysis shows that HTTP header signals alone explain 75% of the blocks unique to Chromium’s headless mode. Notably, 83% of recent top-tier publications fail to report this bias, underscoring its substantial threat to research validity.

This work reveals a previously unexamined vulnerability in large language model (LLM) browser agents: their underlying models can be passively fingerprinted through UI interaction patterns during web tasks, exposing them to targeted attacks. The study introduces the first systematic analysis of this risk and proposes a JavaScript-based passive tracking method that leverages behavioral sequence modeling and machine learning classifiers to identify the specific LLM powering an agent with high accuracy from minimal early interactions. Evaluated across 14 prominent LLMs and four distinct web environments, the approach achieves up to 96% F1 score, demonstrating strong generalization across model scales and families. To facilitate further research, the authors publicly release the collected interaction trajectory dataset and the evaluation framework.

This work addresses the vulnerability of autonomous AI agents to social engineering attacks, which can lead to significant leakage of personally identifiable information (PII). To this end, the authors introduce Scammer4U—the first pre-registered, multi-dimensional benchmark for social engineering attacks—encompassing 91 adversarial scenarios and 10 benign controls, systematically structured using an 8-axis taxonomy. An independent large language model is employed to evaluate the agent’s reasoning process. Experimental results reveal PII disclosure rates of 54%–93% in attack scenarios (0% in benign controls) without privacy-preserving guidance. Notably, even when agents detect suspicious content, 35.9% still disclose PII, exposing a critical “detection-to-action gap” that underscores the inadequacy of current defenses. The study further quantifies the effectiveness of various prompt-level mitigation strategies.