A Deep Web Tracker Detection Method with Coordinated Semantic and Co-Occurrence Features

doi:10.11871/jfdc.issn.2096-742X.2024.03.014

Abstract

Abstract:

[Objective] Web trackers embedded in the website can collect the user identification and access information from user’s visit. The collected information may be used for personalized recommendation services and website performance analysis. However, web trackers may also cause Internet users privacy leakages. It is very important to allow users to selectively turn off/on web tracking, where the automatic detection of web trackers is the premise and foundation. [Methods] By analyzing real-life data sets, this paper reveals two important characteristics of web trackers from the perspectives of URL text semantics and embedded association (i.e., co-occurrence). With this basis, this paper designs a web tracker detection method based on deep learning that consolidates the semantic features and association features of URLs. Specifically, the method first constructs the bipartite graph of the embedding relationship between the websites that users visit directly and the embedded URLs of the websites, and then extracts the embedded feature vector of the URL by applying the DeepWalk algorithm. Secondly, the method extracts the text semantic features of the URL strings using the pre-trained BERT model in the field of natural language processing. Finally, the method uses the attention mechanism to consolidate the two types of features and uses the multi-layer perceptron model to implement URL classification and identify Web trackers. [Results] Experimental results based on real-life data sets show that compared with existing methods, the proposed method improves the recognition accuracy, and its F1 score can reach 0.91. [Conclusions] The proposed method achieves relatively high accuracy in detecting trackers by using only the URLs of trackers and their embedding information in websites. As such, it is easy to be deployed in practice.

Key words: Web tracker detection, association features, deep learning, pre-trained model, DNS

YAN Jin, DONG Kejun, LI Hongtao. A Deep Web Tracker Detection Method with Coordinated Semantic and Co-Occurrence Features[J]. Frontiers of Data and Computing, 2024, 6(3): 127-138, https://cstr.cn/32002.14.jfdc.CN10-1649/TP.2024.03.014.

Figures/Tables 10

Fig.1

Fig. 2

Fig.3

Table 1

Table 2

Table 3

Table 4

Table 5

Table 6

Table 7

References 30

[1]	ENGLEHARDT S, NARAYANAN A. Online Tracking: A 1-million-site Measurement and Analysis[C]// Proc of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), ACM, 2016: 1388-1401.
[2]	CASTELL-UROZ I, SOLE-PARETA J, BARLET-ROS P. Network measurements for web tracking analysis and detection: A tutorial[J]. IEEE Instrumentation & Measurement Magazine, 2020, 23(9): 50-57.
[3]	WANG Z, LI Z, XUE M, TYSON G. Exploring the Eastern Frontier: A First Look at Mobile App Tracking in China[C]// Proc of the 2020 Passive and Active Measurement (PAM), Springer, 2020: 314-328.
[4]	SU J, LI Z, GRUMBACH S, et al. A Cartography of Web Tracking using DNS Records[J]. Computer Communications, 2019, 134: 83-95. doi: 10.1016/j.comcom.2018.11.008
[5]	EasyList. Web跟踪器列表[EB/OL]. [2023-02-25]. https://easylist.to/.
[6]	EasyPrivacy. Web跟踪器列表[EB/OL]. [2023-02-25]. https://easylist.to/easylist/easyprivacy.txt.
[7]	YU Z, MACBETH S, MODI K, et al. Tracking the Trackers[C]// Proc of the 2016 International Conference on World Wide Web (WWW), ACM, 2016: 121-132.
[8]	METWALLEY H, TRAVERSO S, MELLIA M. Unsupervised Detection of Web Trackers[C]// Proc of the 2015 IEEE Global Communications Conference (GLOBECOM), IEEE, 2015: 1-6.
[9]	CASTELL-UROZ I, POISSONNIER T, MANNEBACK P, et al. URL-based Web Tracking Detection Using Deep Learning[C]// Proc of the 16th International Conference on Network and Service Management (CNSM), IEEE, 2020: 1-5.
[10]	GUGELMANN D, HAPPE H, AGER B, et al. An Automated Approach for Complementing Ad Blockers’ Blacklists[C]// Proc of the Privacy Enhancing Technologies (PET), 2015: 282-298.
[11]	KALAVRI V, BLACKBURN J, VARVELLO M, et al. Like a Pack of Wolves: Community Structure of Web Trackers[C]// Proc of the 2016 Passive and Active Measurement (PAM), 2016: 42-54.
[12]	IKRAM M, ASGHAR H, KAAFAR H, et al. Towards Seamless Tracking-Free Web: Improved Detection of Trackers via One-class Learning[C]// Proc of the 2017 Privacy Enhancing Technologies, 2017: 79-99
[13]	WU Q, LIU Q, ZHANG Y, et al. A machine learning approach for detecting third-party trackers on the web[C]// Proc of the European Symposium on Research in Computer Security, Springer, 2016: 238-258.
[14]	IQBAL U, SNYDER P, ZHU S, et al. Adgraph: A graph-based approach to ad and tracker blocking[C]// Proc of the 2020 IEEE Symposium on Security and Privacy (S&P), IEEE, 2020: 763-776.
[15]	CASTELL-UROZ I, SOLÉ-PARETA J, BARLET-ROS P. TrackSign: Guided Web Tracking Discovery[C]// Proc of the IEEE INFOCOM 2021, IEEE, 2021: 1-10.
[16]	PEROZZI B, AL-RFOU R, SKIENA S. Deepwalk: Online learning of social representations[C]// Proc of the 20th ACM International Conference on Knowledge Discovery and data mining (KDD), ACM, 2014: 701-710.
[17]	AdBlock Plus. 广告拦截工具[EB/OL].[2023-02-25]. https://adblockplus.org/en/.
[18]	Ghostery. “Ghostery Makes the Web Cleaner, Faster and Safer!,”[EB/OL]. [2020-02-02]. https://www.ghostery.com/.
[19]	HILL R. “uBlock Origin”[EB/OL]. [2020-02-02]. https://github.com/gorhill/uBlock.
[20]	Disconnect. “Disconnect \| Take back your privacy,”[EB/OL], [2020-02-02]. http://disconnect.me.
[21]	LI Z, YANG D, LI Z, et al. Mobile Content Hosting Infrastructure in China: A View from a Cellular ISP[C]// Proc. of the 2018 Passive and Active Measurement (PAM), Springer, 2018: 100-113
[22]	SCHÜPPEN S, TEUBERT D, HERRMANN P, et al. FANCI : Feature-based automated nxdomain classification and intelligence[C]// Proc of the 27th USENIX Security Symposium, USENIX Association, 2018: 1165-1181.
[23]	ANDERSON H S, WOODBRIDGE J, FILAR B. Deepdga: Adversarially-tuned domain generation and detection[C]// Proc of the 2016 ACM Workshop on Artificial Intelligence and Security, ACM 2016: 13-21.
[24]	SUN X, WANG Z, YANG J, et al. Deepdom: Malicious domain detection with scalable and heterogeneous graph convolutional networks[J]. Computers & Security, 2020, 99: 1-16
[25]	MIKOLOV T, CHEN K, CORRADO G, et al. Efficient estimation of word representations in vector space[J/OL]. arXiv preprint, 2013. https://doi.org/10.48550/arXiv.1301.3781
[26]	DEVLIN J, CHANG M, LEE K, et al. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding[C]// Proc. of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics:Human Language Technologies, NAACL-HLT 2019, 1: 4171-4186.
[27]	VASWANI A, SHAZEER N, PARMAR N, et al. Attention Is All You Need[J/OL]. arXiv preprint, 2017. https://doi.org/10.48550/arXiv.1706.03762.
[28]	CASTELL-UROZ I. Web tracking datasets[EB/OL]. [2023-02-25]. https://www.cba.upc.edu/downloads/category/29-web-tracking-datasets.
[29]	COOPER K. Alexa: Most popular website list[EB/OL]. [2022-12-01]. https://www.alexa.com/.
[30]	PASZKE A, GROSS S, MASSA F, et al. Pytorch: An imperative style, high-performance deep learning library[C]// Proc. of the 33rd International Conference on Neural Information Processing Systems, Curran Associates Inc., 2019: 8024-8035.

表名	字段名	含义
domain	domain id	用户直接访问的网站域名标识
domain	domain name	网站域名字符串
url	url id	唯一标识嵌入到网站的URL
	url string	嵌入到网站的URL字符串
	tracker label	URL是否为Web跟踪器
domain_url	<domain id, url id>	URL嵌入了domain对应的网站

	Domain数	URL数	跟踪器数	二部图边数
top1,000	1,000	87,308	21,672	99,562
top5,000	5,000	392,249	93,660	453,330
top10,000	10,000	725,229	165,081	886,194
top20,000	20,000	1，338,688	290，469	1，656,905

指标	描述
TP	被正确识别的跟踪器数
FP	被识别跟踪器的正常URL数
TN	被正确识别的正常URL数
FN	被识别为正常的跟踪器数
准确率	被正确识别的跟踪器比例：（TP+TN）/（TP+FP+TN+FN）
精确率	识别为跟踪器的样本中真实跟踪器的比例：TP/（TP+FP）
召回率	真实跟踪器中被正确识别为跟踪器的样本比例：TP/（TP+FN）
F1分数	2精确率召回率/（精确率+召回率）

数据集	方法	准确率	精确率	召回率	F1分数
top1,000	决策树	0.766,7	0.768,1	0.771,4	0.769,7
	随机森林	0.825,0	0.832,3	0.901,4	0.865,5
	逻辑回归	0.785,7	0.793,1	0.845,2	0.818,3
	Label Propagation	0.759,2	0.568,5	0.201,1	0.297,1
	本方法	0.879,3	0.852,5	0.912,9	0.881,7
top5,000	决策树	0.790,0	0.789,6	0.784,9	0.787,3
	随机森林	0.853,4	0.857,0	0.898,5	0.877,2
	逻辑回归	0.814,2	0.818,5	0.856,3	0.837,0
	Label Propagation	0.779,2	0.661,0	0.203,0	0.310,6
	本方法	0.906,1	0.891,1	0.924,5	0.907,5
top10,000	决策树	0.788,6	0.790,0	0.797,2	0.793,5
	随机森林	0.857,2	0.860,9	0.906,1	0.883,0
	逻辑回归	0.813,6	0.818,2	0.859,4	0.838,3
	Label Propagation	0.790,0	0.644,7	0.199,1	0.304,2
	本方法	0.910,4	0.890,2	0.936,6	0.912,8
top20,000	决策树	0.799,6	0.800,7	0.805,8	0.803,2
	随机森林	0.863,0	0.866,3	0.907,5	0.886,4
	逻辑回归	0.817,6	0.822,4	0.864,5	0.842,9
	Label Propagation	0.795,8	0.624,3	0.174,8	0.273,1
	本方法	0.910,9	0.887,6	0.941,4	0.913,7

学习率	准确率	精确率	召回率	F1分数
1e-2	0.669,5	0.677,0	0.643,0	0.659,6
1e-3	0.910,9	0.887,6	0.941,4	0.913,7
1e-4	0.901,0	0.892,1	0.911,3	0.901,6
1e-5	0.856,0	0.823,2	0.905,3	0.862,3