  We present a systematic study of ad blocking - and the associated "arms race"
- as a security problem. We model ad blocking as a state space with four states
and six state transitions, which correspond to techniques that can be deployed
by either publishers or ad blockers. We argue that this is a complete model of
the system. We propose several new ad blocking techniques, including ones that
borrow ideas from rootkits to prevent detection by anti-ad blocking scripts.
Another technique uses the insight that ads must be recognizable by humans to
comply with laws and industry self-regulation. We have built prototype
implementations of three of these techniques, successfully blocking ads and
evading detection. We systematically evaluate our proposed techniques, along
with existing ones, in terms of security, practicality, and legality. We
characterize the order of growth of the development effort required to
create/maintain ad blockers as a function of the growth of the web. Based on
our state-space model, our new techniques, and this systematization, we offer
insights into the likely "end game" of the arms race. We challenge the
widespread assumption that the arms race will escalate indefinitely, and
instead identify a combination of evolving technical and legal factors that
will determine the outcome.
