{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:20:03Z","timestamp":1783009203315,"version":"3.54.5"},"reference-count":56,"publisher":"Privacy Enhancing Technologies Symposium Advisory Board","issue":"1","license":[{"start":{"date-parts":[[2016,12,22]],"date-time":"2016-12-22T00:00:00Z","timestamp":1482364800000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017,1,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p> Numerous tools have been developed to aggressively block the execution of popular JavaScript programs in Web browsers. Such blocking also affects functionality of webpages and impairs user experience. As a consequence, many privacy preserving tools that have been developed to limit online tracking, often executed via JavaScript programs, may suffer from poor performance and limited uptake. A mechanism that can isolate JavaScript programs necessary for proper functioning of the website from tracking JavaScript programs would thus be useful. Through the use of a manually labelled dataset composed of 2,612 JavaScript programs, we show how current privacy preserving tools are ineffective in finding the right balance between blocking tracking JavaScript programs and allowing functional JavaScript code. To the best of our knowledge, this is the first study to assess the performance of current web privacy preserving tools in determining tracking vs. functional JavaScript programs.<\/jats:p>\n               <jats:p> To improve this balance, we examine the two classes of JavaScript programs and hypothesize that tracking JavaScript programs share structural similarities that can be used to differentiate them from functional JavaScript programs. The rationale of our approach is that web developers often \u201cborrow\u201d and customize existing pieces of code in order to embed tracking (resp. functional) JavaScript programs into their webpages. We then propose one-class machine learning classifiers using syntactic and semantic features extracted from JavaScript programs. When trained only on samples of tracking JavaScript programs, our classifiers achieve accuracy of 99%, where the best of the privacy preserving tools achieve accuracy of 78%.<\/jats:p>\n               <jats:p> The performance of our classifiers is comparable to that of traditional two-class SVM. One-class classification, where a training set of only tracking JavaScript programs is used for learning, has the advantage that it requires fewer labelled examples that can be obtained via manual inspection of public lists of well-known trackers. We further test our classifiers and several popular privacy preserving tools on a larger corpus of 4,084 websites with 135,656 JavaScript programs. The output of our best classifier on this data is between 20 to 64% different from the tools under study. We manually analyse a sample of the JavaScript programs for which our classifier is in disagreement with all other privacy preserving tools, and show that our approach is not only able to enhance user web experience by correctly classifying more functional JavaScript programs, but also discovers previously unknown tracking services.<\/jats:p>","DOI":"10.1515\/popets-2017-0006","type":"journal-article","created":{"date-parts":[[2016,12,23]],"date-time":"2016-12-23T19:41:36Z","timestamp":1482522096000},"page":"79-99","source":"Crossref","is-referenced-by-count":53,"title":["Towards Seamless Tracking-Free Web: Improved Detection of Trackers via One-class Learning"],"prefix":"10.56553","volume":"2017","author":[{"given":"Muhammad","family":"Ikram","sequence":"first","affiliation":[{"name":"Data61, CSIRO and UNSW, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hassan Jameel","family":"Asghar","sequence":"additional","affiliation":[{"name":"Data61, CSIRO, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mohamed Ali","family":"Kaafar","sequence":"additional","affiliation":[{"name":"Data61, CSIRO, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Anirban","family":"Mahanti","sequence":"additional","affiliation":[{"name":"Data61, CSIRO, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Balachandar","family":"Krishnamurthy","sequence":"additional","affiliation":[{"name":"ATT Research Lab, New York, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"35752","published-online":{"date-parts":[[2016,12,22]]},"reference":[{"key":"2021040623185693737_j_popets-2017-0006_ref_1_w2aab2b8c11b1b7b1ab1ab1Aa","unstructured":"[1] Adblock Plus. https:\/\/www.adblockplus.org."},{"key":"2021040623185693737_j_popets-2017-0006_ref_2_w2aab2b8c11b1b7b1ab1ab2Aa","unstructured":"[2] difflib - Helpers for computing deltas. Python 2.7.11 documentation, https:\/\/docs.python.org\/2.7\/library\/difflib.html."},{"key":"2021040623185693737_j_popets-2017-0006_ref_3_w2aab2b8c11b1b7b1ab1ab3Aa","unstructured":"[3] Disconnect. https:\/\/www.disconnect.me\/."},{"key":"2021040623185693737_j_popets-2017-0006_ref_4_w2aab2b8c11b1b7b1ab1ab4Aa","unstructured":"[4] Disqus. http:\/\/www.disqus.com\/."},{"key":"2021040623185693737_j_popets-2017-0006_ref_5_w2aab2b8c11b1b7b1ab1ab5Aa","unstructured":"[5] EasyList. https:\/\/easylist-downloads.adblockplus.org\/easylist.txt."},{"key":"2021040623185693737_j_popets-2017-0006_ref_6_w2aab2b8c11b1b7b1ab1ab6Aa","unstructured":"[6] Easyprivacy. https:\/\/easylist.to\/easylist\/easyprivacy.txt."},{"key":"2021040623185693737_j_popets-2017-0006_ref_7_w2aab2b8c11b1b7b1ab1ab7Aa","unstructured":"[7] EFF DNT Policy. https:\/\/www.eff.org\/dnt-policy."},{"key":"2021040623185693737_j_popets-2017-0006_ref_8_w2aab2b8c11b1b7b1ab1ab8Aa","unstructured":"[8] Ghostery. https:\/\/www.ghostery.com."},{"key":"2021040623185693737_j_popets-2017-0006_ref_9_w2aab2b8c11b1b7b1ab1ab9Aa","unstructured":"[9] Ghostery 5.4.7 is ready to run! https:\/\/www.ghostery.com\/intelligence\/consumer-blog\/product-releases\/ghostery-547-is-ready-to-run\/."},{"key":"2021040623185693737_j_popets-2017-0006_ref_10_w2aab2b8c11b1b7b1ab1ac10Aa","unstructured":"[10] Google Analytics. https:\/\/www.google.com\/analytics\/."},{"key":"2021040623185693737_j_popets-2017-0006_ref_11_w2aab2b8c11b1b7b1ab1ac11Aa","unstructured":"[11] Javascript Obfuscator. Dan\u2019s tools, http:\/\/www.danstools.com\/javascript-obfuscate\/."},{"key":"2021040623185693737_j_popets-2017-0006_ref_12_w2aab2b8c11b1b7b1ab1ac12Aa","unstructured":"[12] Known Adblock Plus Subscriptions. https:\/\/adblockplus. org\/subscriptions."},{"key":"2021040623185693737_j_popets-2017-0006_ref_13_w2aab2b8c11b1b7b1ab1ac13Aa","unstructured":"[13] Moat. http:\/\/www.moat.com\/."},{"key":"2021040623185693737_j_popets-2017-0006_ref_14_w2aab2b8c11b1b7b1ab1ac14Aa","unstructured":"[14] NoScript. https:\/\/www.noscript.net."},{"key":"2021040623185693737_j_popets-2017-0006_ref_15_w2aab2b8c11b1b7b1ab1ac15Aa","unstructured":"[15] PFanboyList. https:\/\/easylist-downloads.adblockplus.org\/fanboy-social.txt."},{"key":"2021040623185693737_j_popets-2017-0006_ref_16_w2aab2b8c11b1b7b1ab1ac16Aa","unstructured":"[16] Privacy Badger Firefox. https:\/\/github.com\/EFForg\/privacybadgerfirefox\/blob\/master\/data\/cookieblocklist.txt."},{"key":"2021040623185693737_j_popets-2017-0006_ref_17_w2aab2b8c11b1b7b1ab1ac17Aa","unstructured":"[17] Real-Time Digital Advertising That Works | Criteo. http: \/\/www.criteo.com."},{"key":"2021040623185693737_j_popets-2017-0006_ref_18_w2aab2b8c11b1b7b1ab1ac18Aa","unstructured":"[18] Script Surrogates Quick Reference. https:\/\/hackademix.net\/2011\/09\/29\/script-surrogates-quick-reference\/."},{"key":"2021040623185693737_j_popets-2017-0006_ref_19_w2aab2b8c11b1b7b1ab1ac19Aa","unstructured":"[19] Search Results in Ghostery - 381 Topics Found for Breaking. https:\/\/getsatisfaction.com\/ghostery\/searches?query=breaking&x=15&y=10&style=topics."},{"key":"2021040623185693737_j_popets-2017-0006_ref_20_w2aab2b8c11b1b7b1ab1ac20Aa","unstructured":"[20] Visual Revenue. http:\/\/www.visualrevenue.com."},{"key":"2021040623185693737_j_popets-2017-0006_ref_21_w2aab2b8c11b1b7b1ab1ac21Aa","unstructured":"[21] What is Selenium? http:\/\/www.seleniumhq.org\/."},{"key":"2021040623185693737_j_popets-2017-0006_ref_22_w2aab2b8c11b1b7b1ab1ac22Aa","doi-asserted-by":"crossref","unstructured":"[22] G. Acar, C. Eubank, S. Englehardt, M. Juarez, A. Narayanan, and C. Diaz. The Web Never Forgets: Persistent Tracking Mechanisms in the Wild. CCS, 2014.","DOI":"10.1145\/2660267.2660347"},{"key":"2021040623185693737_j_popets-2017-0006_ref_23_w2aab2b8c11b1b7b1ab1ac23Aa","doi-asserted-by":"crossref","unstructured":"[23] S. Basu, M. Bilenko, and R. J. Mooney. A Probabilistic Framework for Semi-supervised Clustering. KDD, 2004.","DOI":"10.1145\/1014052.1014062"},{"key":"2021040623185693737_j_popets-2017-0006_ref_24_w2aab2b8c11b1b7b1ab1ac24Aa","doi-asserted-by":"crossref","unstructured":"[24] A. Chaabane, M. A. Kaafar, and R. Boreli. Big Friend is Watching You: Analyzing Online Social Networks Tracking Capabilities. WOSN, 2012.","DOI":"10.1145\/2342549.2342552"},{"key":"2021040623185693737_j_popets-2017-0006_ref_25_w2aab2b8c11b1b7b1ab1ac25Aa","doi-asserted-by":"crossref","unstructured":"[25] C.-C. Chang and C.-J. Lin. LIBSVM: A Library for Support Vector Machines. ACM ToIST, 2011.","DOI":"10.1145\/1961189.1961199"},{"key":"2021040623185693737_j_popets-2017-0006_ref_26_w2aab2b8c11b1b7b1ab1ac26Aa","unstructured":"[26] N. Corporation. January 2013: Top U.S. Entertainment Sites and Web Brands. Visited 23 May 2016, http:\/\/www.nielsen.com\/us\/en\/insights\/news\/2013\/january-2013--top-u-s--entertainment-sites-and-web-brands.html, 2013."},{"key":"2021040623185693737_j_popets-2017-0006_ref_27_w2aab2b8c11b1b7b1ab1ac27Aa","unstructured":"[27] C. Curtsinger, B. Livshits, B. Zorn, and C. Seifert. ZOZZLE: Fast and Precise In-browser JavaScript Malware Detection. USENIX SEC, 2011."},{"key":"2021040623185693737_j_popets-2017-0006_ref_28_w2aab2b8c11b1b7b1ab1ac28Aa","doi-asserted-by":"crossref","unstructured":"[28] C. Elkan and K. Noto. Learning Classifiers from Only Positive and Unlabeled Data. KDD, 2008.","DOI":"10.1145\/1401890.1401920"},{"key":"2021040623185693737_j_popets-2017-0006_ref_29_w2aab2b8c11b1b7b1ab1ac29Aa","doi-asserted-by":"crossref","unstructured":"[29] J. Erman, A. Mahanti, M. Arlitt, I. Cohen, and C. Williamson. Offline\/Realtime Traffic Classification Using Semi-supervised Learning. Perform. Eval., 2007.","DOI":"10.1016\/j.peva.2007.06.014"},{"key":"2021040623185693737_j_popets-2017-0006_ref_30_w2aab2b8c11b1b7b1ab1ac30Aa","unstructured":"[30] P. Gill, V. Erramilli, A. Chaintreau, B. Krishnamurthy, K. Papagiannaki, and P. Rodriguez. Follow the Money: Understanding Economics of Online Aggregation and Advertising. IMC, 2013."},{"key":"2021040623185693737_j_popets-2017-0006_ref_31_w2aab2b8c11b1b7b1ab1ac31Aa","doi-asserted-by":"crossref","unstructured":"[31] D. Gugelmann, B. Ager, and V. Lenders. An Automated Approach for Complementing Ad Blockers\u2019 Blacklists. PETs, 2015.","DOI":"10.1515\/popets-2015-0018"},{"key":"2021040623185693737_j_popets-2017-0006_ref_32_w2aab2b8c11b1b7b1ab1ac32Aa","doi-asserted-by":"crossref","unstructured":"[32] C.-H. Hsiao, M. Cafarella, and S. Narayanasamy. Using Web Corpus Statistics for Program Analysis. OOPSLA, 2014.","DOI":"10.1145\/2660193.2660226"},{"key":"2021040623185693737_j_popets-2017-0006_ref_33_w2aab2b8c11b1b7b1ab1ac33Aa","doi-asserted-by":"crossref","unstructured":"[33] M. Ikram, H. Asghar, M. A. Kaafar, and A. Mahanti. On the Intrusiveness of JavaScript on the Web. CoNEXT, Student Workshop, 2014.","DOI":"10.1145\/2680821.2680837"},{"key":"2021040623185693737_j_popets-2017-0006_ref_34_w2aab2b8c11b1b7b1ab1ac34Aa","unstructured":"[34] M. Ikram, H. J. Asghar, M. A. Kaafar, B. Krishnamurthy, and A. Mahanti. Towards seamless tracking-free web: Improved detection of trackers via one-class learning. arXiv (pre-print), doi: 603.06289."},{"key":"2021040623185693737_j_popets-2017-0006_ref_35_w2aab2b8c11b1b7b1ab1ac35Aa","doi-asserted-by":"crossref","unstructured":"[35] D. Jang, R. Jhala, S. Lerner, and H. Shacham. An Empirical Study of Privacy-violating Information Flows in JavaScript Web Applications. CCS, 2010.","DOI":"10.1145\/1866307.1866339"},{"key":"2021040623185693737_j_popets-2017-0006_ref_36_w2aab2b8c11b1b7b1ab1ac36Aa","doi-asserted-by":"crossref","unstructured":"[36] B. Krishnamurthy. I Know What You Will Do Next Summer.SIGCOMM CCR, 2010.","DOI":"10.1145\/1880153.1880164"},{"key":"2021040623185693737_j_popets-2017-0006_ref_37_w2aab2b8c11b1b7b1ab1ac37Aa","doi-asserted-by":"crossref","unstructured":"[37] B. Krishnamurthy, D. Malandrino, and C. E. Wills. Measuring Privacy Loss and the Impact of Privacy Protection in Web Browsing. SOUPS, 2007.","DOI":"10.1145\/1280680.1280688"},{"key":"2021040623185693737_j_popets-2017-0006_ref_38_w2aab2b8c11b1b7b1ab1ac38Aa","unstructured":"[38] B. Krishnamurthy, K. Naryshkin, and C. Wills. Privacy leakage vs. Protection measures: The Growing Disconnect. W2SP, 2011."},{"key":"2021040623185693737_j_popets-2017-0006_ref_39_w2aab2b8c11b1b7b1ab1ac39Aa","doi-asserted-by":"crossref","unstructured":"[39] P. Leon, B. Ur, R. Shay, Y. Wang, R. Balebako, and L. Cranor.Why Johnny Can\u2019T Opt out: A Usability Evaluation of Tools to Limit Online Behavioral Advertising. In SIGCHI, 2012.","DOI":"10.1145\/2207676.2207759"},{"key":"2021040623185693737_j_popets-2017-0006_ref_40_w2aab2b8c11b1b7b1ab1ac40Aa","unstructured":"[40] B. Liu, Y. Dai, X. Li, W. S. Lee, and P. S. Yu. Building Text Classifiers Using Positive and Unlabeled Examples.ICDM, 2003."},{"key":"2021040623185693737_j_popets-2017-0006_ref_41_w2aab2b8c11b1b7b1ab1ac41Aa","doi-asserted-by":"crossref","unstructured":"[41] J. R. Mayer and J. C. Mitchell. Third-Party Web Tracking: Policy and Technology. IEEE S&P, 2012.","DOI":"10.1109\/SP.2012.47"},{"key":"2021040623185693737_j_popets-2017-0006_ref_42_w2aab2b8c11b1b7b1ab1ac42Aa","doi-asserted-by":"crossref","unstructured":"[42] H. Metwalley, S. Traverso, and M. Mellia. The Online Tracking Horde: a View from Passive Measurements. TMA, 2015.","DOI":"10.1007\/978-3-319-17172-2_8"},{"key":"2021040623185693737_j_popets-2017-0006_ref_43_w2aab2b8c11b1b7b1ab1ac43Aa","unstructured":"[43] S. S. Muchnick. Advanced Compiler Design and Implementation.MK Publishers Inc., 1997."},{"key":"2021040623185693737_j_popets-2017-0006_ref_44_w2aab2b8c11b1b7b1ab1ac44Aa","doi-asserted-by":"crossref","unstructured":"[44] K. R. Muller, S. Mika, G. Ratsch, K. Tsuda, and B. Scholkopf. An Introduction to Kernel-based Learning Algorithms. ToNN, 2001.","DOI":"10.1109\/72.914517"},{"key":"2021040623185693737_j_popets-2017-0006_ref_45_w2aab2b8c11b1b7b1ab1ac45Aa","doi-asserted-by":"crossref","unstructured":"[45] N. Nikiforakis, A. Kapravelos, W. Joosen, C. Kruegel, F. Piessens, and G. Vigna. Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting. IEEE S&P, 2013.","DOI":"10.1109\/SP.2013.43"},{"key":"2021040623185693737_j_popets-2017-0006_ref_46_w2aab2b8c11b1b7b1ab1ac46Aa","unstructured":"[46] L. Olejnik, C. Castelluccia, and A. Janc. Why Johnny Can\u2019t Browse in Peace: On the Uniqueness of Web Browsing History Patterns. HotPETs, 2012."},{"key":"2021040623185693737_j_popets-2017-0006_ref_47_w2aab2b8c11b1b7b1ab1ac47Aa","doi-asserted-by":"crossref","unstructured":"[47] C. R. Orr, A. Chauhan, M. Gupta, C. J. Frisz, and C. W.Dunn. An Approach for Identifying JavaScript-loaded Advertisements Through Static Program Analysis. WPES, 2012.","DOI":"10.1145\/2381966.2381968"},{"key":"2021040623185693737_j_popets-2017-0006_ref_48_w2aab2b8c11b1b7b1ab1ac48Aa","unstructured":"[48] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine Learning in Python. J. Mach. Learn. Res., 2011."},{"key":"2021040623185693737_j_popets-2017-0006_ref_49_w2aab2b8c11b1b7b1ab1ac49Aa","doi-asserted-by":"crossref","unstructured":"[49] Rieck, Konrad and Krueger, Tammo and Dewald, Andreas.Cujo: Efficient detection and prevention of driveby- download attacks. ACSAC, 2010.","DOI":"10.1145\/1920261.1920267"},{"key":"2021040623185693737_j_popets-2017-0006_ref_50_w2aab2b8c11b1b7b1ab1ac50Aa","unstructured":"[50] F. Roesner, T. Kohno, and D. Wetherall. Detecting and Defending Against Third-party Tracking on the Web. NSDI, 2012."},{"key":"2021040623185693737_j_popets-2017-0006_ref_51_w2aab2b8c11b1b7b1ab1ac51Aa","doi-asserted-by":"crossref","unstructured":"[51] B. Sch\u00f6lkopf, J. C. Platt, J. C. Shawe-Taylor, A. J. Smola, and R. C. Williamson. Estimating the Support of a High- Dimensional Distribution. NC, 2001.","DOI":"10.1162\/089976601750264965"},{"key":"2021040623185693737_j_popets-2017-0006_ref_52_w2aab2b8c11b1b7b1ab1ac52Aa","doi-asserted-by":"crossref","unstructured":"[52] M. Tran, X. Dong, Z. Liang, and X. Jiang. Tracking the Trackers: Fast and Scalable Dynamic Analysis of Web Content for Privacy Violations. ACNS, 2012.","DOI":"10.1007\/978-3-642-31284-7_25"},{"key":"2021040623185693737_j_popets-2017-0006_ref_53_w2aab2b8c11b1b7b1ab1ac53Aa","doi-asserted-by":"crossref","unstructured":"[53] C. Wills and D. Uzunoglu. What Ad Blockers Are (and Are Not) Doing. WPI-CS-TR-16-02, 2016.","DOI":"10.1109\/HotWeb.2016.21"},{"key":"2021040623185693737_j_popets-2017-0006_ref_54_w2aab2b8c11b1b7b1ab1ac54Aa","doi-asserted-by":"crossref","unstructured":"[54] W. Xu, F. Zhang, and S. Zhu. The Power of Obfuscation Techniques in Malicious JavaScript Code: A Measurement Study. MALWARE, 2012.","DOI":"10.1109\/MALWARE.2012.6461002"},{"key":"2021040623185693737_j_popets-2017-0006_ref_55_w2aab2b8c11b1b7b1ab1ac55Aa","unstructured":"[55] T.-F. Yen, Y. Xie, F. Yu, R. P. Yu, and M. Abadi. Host Fingerprinting and Tracking on the Web: Privacy and Security Implications. NDSS, 2012."},{"key":"2021040623185693737_j_popets-2017-0006_ref_56_w2aab2b8c11b1b7b1ab1ac56Aa","doi-asserted-by":"crossref","unstructured":"[56] C. Yue and H. Wang. Characterizing Insecure Javascript Practices on the Web. WWW, 2009.","DOI":"10.1145\/1526709.1526838"}],"container-title":["Proceedings on Privacy Enhancing Technologies"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/content.sciendo.com\/view\/journals\/popets\/2017\/1\/article-p79.xml","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.sciendo.com\/article\/10.1515\/popets-2017-0006","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,20]],"date-time":"2022-07-20T16:29:36Z","timestamp":1658334576000},"score":1,"resource":{"primary":{"URL":"https:\/\/petsymposium.org\/popets\/2017\/popets-2017-0006.php"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,12,22]]},"references-count":56,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2016,12,22]]},"published-print":{"date-parts":[[2017,1,1]]}},"alternative-id":["10.1515\/popets-2017-0006"],"URL":"https:\/\/doi.org\/10.1515\/popets-2017-0006","relation":{},"ISSN":["2299-0984"],"issn-type":[{"value":"2299-0984","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,12,22]]}}}