# US 11,308,502 B2 · Method for detecting web tracking services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,502 B2 - Document ID: US11308502B2 - Status: Granted - Kind: B2 - Application number: 15/771,003 - Filed: 2016-12-01 - Published: 2018-11-15 - Granted: 2022-04-19 - Earliest claimed: 2015-12-02 - Assignees: Politecnico Di Torino - Applicants: Politecnico Di Torino - Inventors: Hassan Esam Hassan Metwalley; Stefano Traverso; Marco Mellia - Web page: https://patentgrep.com/patent/US11308502B2 ## CPC - G06Q 30/02: Marketing; Price estimation or determination; Fundraising - G06F 16/221: {Column-oriented storage; Management thereof} - G06F 16/95: Retrieval from the web - G06Q 30/0619: {Neutral agent} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for detecting web tracking services during browsing activity performed by clients having associated client identifiers includes the steps of extracting key-value pairs contained into navigation data, looking for one-to-one correspondence between said client identifiers and the values contained in said keys and selecting the keys for which at least a client-value one-to-one correspondence for at least a predetermined number of clients is observed, the keys identifying the associated services as services performing tracking activities. ## Claims ### Claim 1 A method for detecting web tracking services during browsing activities performed by a plurality of clients associated with a plurality of client identifiers, the method comprising the steps of: for each of said plurality of clients, extracting key-value pairs contained in navigation data, said key-value pairs being directed or referred to a targeted website domain, each of said key-value pairs containing a corresponding key and a corresponding value; analyzing key-value pairs associated with said plurality of clients to determine whether values associated to a particular key contained in said key-value pairs exhibit one-to-one correspondence with said client identifiers; in response to determining that said key-value pairs containing said particular key whose values are one-to-one correspondence with said client identifiers, selecting said particular key; identifying a service that is associated with said particular key as a service performing tracking activities; and adding said service performing tracking activities to a curated blacklist used for blocking at least a portion of network traffic toward said service performing tracking activities. ### Claim 2 (depends on 1) The method according to claim 1, wherein said one-to-one correspondence is observed, for each of the clients, across different and progressive uses of the same navigation data. ### Claim 3 (depends on 1) The method according to claim 1, wherein said navigation data are HTTP or HTTPS GET requests or data transmitted via POST requests or data embedded in cookies. ### Claim 4 (depends on 1) The method according to claim 1, wherein first-party tracking services are detected. ### Claim 5 (depends on 1) The method according to claim 1, wherein third-party tracking services are detected. ### Claim 6 (depends on 1) The method according to claim 1, wherein combinations of said key-value pairs whose values exhibit one-to-one correspondence with a client are detected. ### Claim 7 (depends on 1) The method according to claim 1, wherein said predetermined number of clients is determined so as neither to misclassify keys that contain other kind of information nor to cut out legit positive keys associated to a large set of third-party objects that may not be always present. ### Claim 8 (depends on 2) The method according to claim 2, wherein said navigation data are HTTP or HTTPS GET requests or data transmitted via POST requests or data embedded in cookies. ### Claim 9 (depends on 2) The method according to claim 2, wherein first-party tracking services are detected. ### Claim 10 (depends on 2) The method according to claim 2, wherein third-party tracking services are detected. ### Claim 11 (depends on 2) The method according to claim 2, wherein combinations of said key-value pairs whose values exhibit one-to-one correspondence with a client are detected. ### Claim 12 (depends on 2) The method according to claim 2, wherein said predetermined number of clients is determined so as neither to misclassify keys that contain other kind of information nor to cut out legit positive keys associated to a large set of third-party objects that may not be always present. ### Claim 13 A method for detecting web tracking services during browsing activities performed by clients, the method comprising the steps of: extracting key-value pairs contained in navigation data associated with a plurality of clients, said navigation data being directed to or referring to a targeted domain, each of said key-value pairs containing a corresponding key and a corresponding value; analyzing key-value pairs associated with a plurality of different visits by said plurality of clients to determine whether values associated to a particular key contained in said key-value pairs exhibit one-to-one correspondence with said clients, such that different clients correspond to different values while a given client corresponds to a same value across different visits by said same given client; in response to determining that said key-value pairs containing said particular key whose values are one-to-one correspondence with said clients, selecting said particular key; identifying a service that has used said particular key to perform tracking activities; and adding said service performing tracking activities to a curated blacklist used for blocking at least a portion of network traffic toward said service performing tracking activities. ### Claim 14 (depends on 13) The method according to claim 13, wherein said one-to-one correspondence is observed, for each of the clients, across different uses of the same navigation data. ### Claim 15 (depends on 13) The method according to claim 13, wherein said navigation data is contained in one or more HTTP requests, one or more HTTPS GET requests, data transmitted via one or more POST request, or data embedded in one or more cookies. ### Claim 16 (depends on 13) The method according to claim 13, wherein the targeted domain and service performing tracking activities are the same entity, such that first-party tracking services are detected. ### Claim 17 (depends on 13) The method according to claim 13, wherein the targeted domain and service performing tracking activities are different entities, such that third-party tracking services are detected. ### Claim 18 (depends on 13) The method according to claim 13, wherein combinations of said key-value pairs whose values exhibit one-to-one correspondence with a client are detected. ### Claim 19 (depends on 13) The method according to claim 13, wherein said predetermined number of clients is determined based on risk of misclassifying keys that contain other kind of information compared to risk of cutting out legit positive keys associated to a large set of third-party objects that may not be always present.