This document summarizes research on developing a user-centric approach for controlling web tracking. The researchers studied how web trackers work and conducted experiments to analyze tracking mechanisms. Their proposed solution is a policy engine and sandbox framework that allows users to enforce fine-grained policies over third-party trackers on websites. Future work includes implementing a policy specification and enforcement design to give users control over how their data is tracked online. The goal is to balance personalization, analytics and targeted advertising with user privacy and security.

1. An user-centric approach to
controlling web-tracking
Zhengying Zhou and Rakesh S V Reddy
Mentor: Dr. Phu H. Phung
Intelligent Systems Security Lab
Department of Computer Science
University of Dayton
2018 Summer Science Research Symposium
July 25th, 2018
1

2. A Web-tracking Scenario (1)
2

3. A Web-tracking Scenario (2)
3

4. 1
2
Web-tracking Explained
4
Web-Tracker

5. A solution: Ghostery Ad-blocker extension
5

6. Motivation
● Personalization
● Site analytics
● Targeted advertising
6
How do we ensure secure web-tracking?
Do we still need web-tracking?

7. Research Objectives
● Study the web-tracking mechanisms.
● Propose a framework to control the web-tracking that allows the
users to enforce fine-grained policies over a third-party on web
7

8. Tracking Mechanisms - A study
● widely known
● placed in a browser storage by
the web server
● E.g.: Single sign-on
● More accurate
● browser type and version,
operating system and version,
screen resolution, supported
fonts, plugins, timezone,
language and font preferences
● Web bugs
● Tiny invisible objects downloaded as
images embedded into a web page or
email
8
Image source: https://medium.freecodecamp.org/what-you-should-know-about-web-tracking-and-how-it-affects-your-online-privacy-42935355525

9. Experiments
9
1
2
www.site1.com www.tracker.com
www.site2.com

10. Experimental results (1)
10

11. Experimental results (2)
11
On http://www.site2.com

12. Experimental results (3)
12

13. Our approach to controlling
web-tracking
Sandbox
Policy Engine
1
2
13

14. Policy Enforcement Engine Architecture
Policy Engine
1
2
Sandbox
Policy for Amazon
Policy for Yelp
14

15. Sandbox Implementation
We adopt a framework from [Phung et al, TDSC 2015]
15[Phung et al, TDSC 2015] Phung, P. H., Monshizadeh, M., Sridhar, M., & Hamlen, K. W. (2015). Between worlds: Securing mixed
Javascript/Actionscript multi-party web content. IEEE Transactions on Dependable and Secure Computing, 12(4), 443-457.

16. Future work
● Policy specification and enforcement design and implementation
○ Adapt some of related specification in the web-based mobile applications (Another summer
project in the lab)
16

17. Acknowledgements
❖ UDayton, College of Arts and Sciences Dean’s Summer Fellowship
❖ The University of Dayton Research Council Seed Grants (RCSG)
17

18. THANK YOU
18