Assessing the Limits of Privacy and Data Usage for Web Browsing Analytics

Abstract

Web browsing analytics provides insights on the websites that users access, which affects their privacy. Although this analysis might be seen as an easy task, different problems, such as encryption, the tangled web, with several domains visited at the same time in a single web page, or IP addresses of a cloud provider shared by several sites, make it a though job. However, despite these issues, users' privacy is still unaccomplished, as we show in this work. We provide a novel approach that only takes into account the IP addresses that the user has connected to without performing any reverse DNS lookup. We use this sequence of addresses as an input of a neural network, which is able to identify accurately which was the website actually visited among Alexa's World Top 500 most visited domains. Moreover, we have also studied other factors, such as the dependence on the DNS server used to resolve the visited IP addresses, the accuracy for the top domains (e.g., Google, YouTube, Facebook, etc.), data augmentation to improve our results, or the impact on packet sampling. In this last case, we conclude that, using only a 10% of the packets, we can identify the visited website with an accuracy of 93%, whereas it can be over 97% if there is no packet sampling and we use data augmentation.