Instrumentation & Measurement Magazine 23-9 - 50

Network Measurements for Web
Tracking Analysis and Detection:
A Tutorial
Ismael Castell-Uroz, Josep Solé-Pareta, and Pere Barlet-Ros

igital society has developed to a point where it is
nearly impossible for a user to know what it is happening in the background when using the Internet.
To understand it, it is necessary to perform network measurements not only at the network layer (e.g., IP, ICMP), but also
at the application layer (e.g., HTTP). For example, opening
a single website can trigger a cascade of requests to different
servers and services to obtain the resources embedded inside
it. This process is becoming so complex that, to explore only
one website, the number of communications can explode easily from tens to hundreds depending on the website. Inside
those communications, there is an ever-increasing portion
dedicated to web tracking, a controversial practice from the security and privacy perspective [1].
In this article, we present a tutorial on web tracking and
how network measurements are needed to detect and analyze it. We also classify and review the scientific literature on
this specific topic and discuss the open issues and challenges
the measurement community has to address to detect web
tracking more efficiently. Furthermore, we present Online Resource Mapper (ORM), a new large-scale web measurement
framework specifically designed to address these open issues
and facilitate the detection of web tracking. As an additional
contribution, we made public a large-scale dataset collected
with ORM that contains information about all of the resources
being loaded by the most popular 100,000 websites on the Internet [2].

An Overview of Web Tracking
Web tracking is a technology that comprises multiple methods used intentionally to follow and identify individuals
when surfing the Internet. In the beginning, web tracking was
designed to identify users within the web services given by
a company on their own domains. The most famous tracking method is the use of the so-called " Cookies, " small files
saved in the computer by the Internet browser that contain an

identifier of the current domain and browsing session. Cookies are sent automatically by the browser every time a website
of the same domain is accessed. Web tracking is fundamental for online vendors, enabling them to present a shopping
cart to the user, a place to put the items intended for purchase.
This kind of behavior would be impossible without previously
identifying the user.
Recently, web tracking methods crossed the intra-domain
barrier with the appearance of Third-party trackers. Third-party
trackers can track the user in domains not owned by or related to them. This is done by offering useful services to other
companies in the form of embedded resources that can help
to improve the number of users and, consequently, the relevance of their website. An embedded resource is an external
resource like documents, images or scripts not owned by the
company proprietary of the website. A typical and very popular example is the Facebook " Like " button. Many online news,
marketplaces and content hosting websites include them (or
similar elements from other social networks). However, the
fact that Facebook (and the rest of the embedded services) can
track the user in that website, despite not having an account
or never clicking the " Like " button, is mostly unknown by the
common user.
To track users through embedded resources, third-party
tracking methods present an increasing complexity and level
of detail in the collected data. Among the plethora of new web
tracking methods, fingerprinting is the most complex, complete and intrusive of all of them. Fingerprinting tracks not
only the user actions, but also the properties of the computers being used to access the web services and other relevant
characteristics. Collecting information such as the OS version,
browser version, installed fonts, screen dimensions or the city
where the user is (through the network IP address) permits
companies to combine all of them in a way that precisely identifies a user among all of the rest, even when using anonymous
tools, such as private browsing mode [1].

This work was supported by the Spanish MINECO under contract TEC2017-90034-C2-1-R (ALLIANCE).
50

IEEE Instrumentation & Measurement Magazine
1094-6969/20/$25.00©2020IEEE

December 2020

Instrumentation & Measurement Magazine 23-9

Table of Contents for the Digital Edition of Instrumentation & Measurement Magazine 23-9