From Heuristics to ML: Automating User Action Detection in HTTP Traces
Detecting user actions from HTTP traces: Toward an automatic approach
This paper introduces an automated machine learning approach to distinguish explicit user actions (e.g., clicks) from automatic background requests in passive HTTP traces. By evaluating multiple classifiers and a broad feature set on both volunteer-driven and synthetic datasets, the study identifies Random Forest as a top performer, outperforming traditional manually-tuned heuristics.
TL;DR
Determining whether an HTTP request was a deliberate human click or an automated browser fetch is vital for forensics and popularity tracking. This paper moves beyond fragile manual rules by employing Machine Learning (Random Forest) trained on real-world volunteer data. The result? A model that achieves over 91% F-Measure, surpassing previous SOTA heuristics and proving that manual tuning is no longer necessary for accurate web activity reconstruction.
The "Noise" Problem in Modern Web Traces
In the early days of the web, one request usually equaled one page. Today, visiting a single homepage can trigger 200+ secondary requests for trackers, images, and scripts. Furthermore, background services like Dropbox or Windows Update generate significant HTTP "noise."
Existing methods, like StreamStructure, relied on "Expert Intuition"—manual thresholds on file sizes or specific header fields. These methods are brittle; they break as soon as web technologies evolve or when browsers change how they handle Referer fields.
Methodology: Bridging the Reality Gap
The authors' core contribution lies in their data collection and feature engineering. They didn't just rely on bots (Synthetic Data); they instrumented 10 real volunteers' browsers to get the absolute Ground Truth.
1. The Data Pipeline
The authors collected traffic at the edge router using Tstat while simultaneously logging browser history. By matching timestamps and URLs, they created a perfectly labeled dataset of "User Actions" vs. "Automatic Fetches."
2. Feature Selection: What Actually Matters?
The study analyzed 18 features. Through Information Gain (IG) analysis, they discovered that the Number of Children (how many subsequent requests point back to this URL as a referer) is the single most powerful predictor.
| Feature Group | Key Insight |
|---|---|
| Referer Relations | "Number of children" and "Time to parent" are high IG features. |
| Object Metadata | Content-Type helps filter out scripts/images. |
| Temporal | The time interval () between requests reflects human "dwell time." |
Performance: The Superiority of Random Forests
The researchers tested Decision Trees, Random Forests (RF), Bayesian Networks, and MLPs. Random Forest consistently emerged as the winner.
Even when removing Referer-based features (which are often missing due to modern privacy settings), the ML models maintained a respectable F-Measure of 84.6%, whereas older heuristics would have completely failed.
Critical Insight: The Synthetic Data Trap
Perhaps the most important finding is the comparison between training on Synthetic vs. Real data.
- Models trained/tested on synthetic data look "perfect" (97% F-Measure).
- However, when a model trained on synthetic data is used on real human traffic, its performance collapses to 52.9%.
This highlights a massive "Inductive Bias" in synthetic datasets: bots don't browse like humans. Human behavior is sporadic, uses caching differently, and interacts with a wider variety of domains.
Conclusion & Future Outlook
This work marks a shift toward automated network forensics. By using Machine Learning, we can build robust systems that adapt to the web's evolution without manual re-calibration.
Takeaway for the Industry: If you are building traffic analysis tools, stop relying on fixed rules. However, be wary of your training data—if your "ground truth" comes from a headless browser script, your model will likely fail in the real world. The next frontier? Performing this same classification on encrypted HTTPS traffic using side-channel features like packet sizing and timing.