Personal Monitoring of Web Information Exchange: Towards Web Lifelogging

Transcription

1 Personal Monitoring of Web Information Exchange: Towards Web Lifelogging Mathieu d Aquin, Salman Elahi and Enrico Motta Knowledge Media Institute, The Open University Walton Hall, Milton Keynes, MK7 6AA, UK {m.daquin, s.elahi, e.motta}@open.ac.uk ABSTRACT With more and more services relying on the Web to communicate with their users, the amount of information exchanged daily by an individual through various Web channels has become difficult to control. Not only have Web 2.0 applications participated to this increase from within the browser, but many other tools now rely on the Web as their basic communication infrastructure, including RSS aggregators, social network apps, update sites, etc. While in principle this gives better possibilities to share and exchange information with various people and organizations, it also makes it more difficult for Web users to fully comprehend, explore and exploit exchanges of their own data. In this paper, we present a set of tools and an experiment on using semantic data management to track and record users Web activities, as a way of personal monitoring. More specifically, we describe a tool, a Web lifelogger, dedicated to tracking every exchanges realized over the Web and to store these logs using semantic technologies. We run an experiment on using such a tool for a period of 2.5 months for a particular user, and show how the collected data can be used by the user to monitor and study his own online behavior. We detail in particular the computation of basic analytics (related to the time of Web activities, the locations of the exchanges, etc.), the creation of a model of the perceived trust relationship this user has with different websites (based on the data he exchanged with them) and an investigation on what we can learn about the user from analyzing his use of Web search engines. 1. INTRODUCTION On today s Web, information is constantly being exchanged between the users and various websites. However, the mechanisms allowing individual users to keep track of their activity on the Web are still limited. Indeed, they are often based on a Web 1.0 model, where interaction is restricted to visiting Web pages, therefore ignoring the inherent complexity of Web exchanges. This applies of course to the simple history feature included in most Web browsers, but also to more recent tools such as Google Web History 1, which focuses only on searches and web page visits, realized within a single Web browser. As our initial experiments (see be- 1 Copyright is held by the authors. Web Science Conf. 2010, April 26-27, 2010, Raleigh, NC, USA.. low) showed us, Web users activities are a lot more complex than what can be captured by such tools, spreading over multiple agents and including many different forms of interactions, beyond search and consultation. In addition, because of this increasing complexity, it is becoming more and more important to provide the users with the means to monitor the full range of their activities, giving them the ability to keep track, memorize and control their information exchange. In this paper, we present a set of tools and an experiment dedicated to the personal monitoring of Web activities. In other terms, we consider here the complete Web life of individual users, in what can be described as the Web equivalent of a lifelogging system. Lifelogging is described in [4] as the undiscriminating collection of information concerning one s life and behavior. Here, we developed a system to collect, keep track and make sense of information related to an individual s activity on the Web. Technically, this system is a Web Proxy program which, installed on the computer of the user, intercepts and records any communication occurring with the external Web through the HTTP protocol. As an experiment, we ran this logging system on the computer of the first author of this paper over a period of 2.5 months. This resulted in 9GB of data, corresponding to more than 100 Million triples in RDF and representing over 3 Million HTTP requests (and the corresponding responses). On the basis of these initial results, we show how such data can be used to provide the user with tools that visualize, explore and integrate this information to support him in better understanding, and so controlling, his own online behavior. We first consider basic analytics, similar to the ones computed from the access logs of websites, but taking the perspective of the user. This provides ways to understand for example at what time most of the Web activity takes place, relating this to real-life daily events. It also shows what are the common destinations of Web exchanges and what tools are used, giving an insight on the complexity, fragmentation and level of implicit inherent to Web communication. Considering these results, we then focus on the situation of data exchange and on assessing the trust relationship that exist between the user and various websites. Indeed, looking at what data has been sent to various websites, we can expose the user to what we can perceive as being his level of trust to a given website, and the criticality he associates with various pieces of data. Letting him interact with this model also helps identifying conflicting situations, where the perceived model of trust does not match the user s own view, therefore providing a first step towards a more informed way 1

2 to handle personal privacy management. Finally, search is probably the most common activity on the Web and we show how analyzing the user s search behavior can derive useful information. 2. RELATED WORK A range of tools exist already to support users in monitoring their own Web activity, including tools used to debug communication protocols. More related to our approach here, we can mention for example Google Web History 2 and the Attention Recorder 3. Both take the form of plugins for popular Web browsers, and record accesses to websites in order to build a record of Web activities. Other commercial products such as Rescue Time 4 record general activities on the computer of the user, including websites accessed through the browser, in this case for the purpose of helping them manage their productivity. However, such tools are still limited in the sense that they record only a restricted amount of information (attention data: websites explicitly accessed through the Web browser) and only allow usage of the data which is directly intended by the tool (provide reports and improve the results of search, sharing and optimizing attention, etc.) As it appears in our experiment (see below), data exchange on the Web is a very complex activity, often fragmented and partly implicit. Dedicated tools are therefore needed to monitor them and derive equally complex records of personal Web activities directly for the user s consumption and allowing him to obtain an integrated view on many aspects of his own online behavior, including productivity, search interests, social interaction and privacy. 3. BASIC UNDERLYING TECHNOLOGY AND EXPERIMENT SETTING In order to represent a sufficiently broad overview of personal data transfer on the Web, we need a tool which would fulfill two main requirements: 1- it needs to be transparent to the user, acting in background without disrupting normal Web activities; and 2- it needs to collect information as complete as possible, in particular, independently from the Web agent used (various Web browsers, but also many other tools such as online music programs e.g., itunes and spotify, clients getting Web images and other content from inside s, etc.) For these reasons, we implemented a HTTP logging mechanism as a Web proxy, running on the local computer of the user. A proxy is a tool that acts as an intermediary between a client and external servers the client is trying to connect to. Web proxies are often used in organizations to implement cache control mechanisms for all the Web users inside the organization s network. Here however, we use a Web proxy locally. Web communications can be redirected to it through the system preferences so that any HTTP request going out of the user s computer (and any response back) is intercepted, logged and re-directed to the right destination (which could be another Web proxy). As shown in Figure 1, the logs of the Web activity collected through this tool are represented in RDF, using a simple, ad-hoc HTTP ontology. These logs record Figure 1: Overview of the Web lifelogging system. the complete information included as part of the HTTP protocol (e.g., destination, agent, cache information, referrers, etc.), as well as pointers to the actual data exchanged, which is saved on the local file system. As a way of experimenting with Web lifelogging, we ran this logging proxy on the computer of the first author of this paper for a period of 2.5 months (uninterrupted). This led to a record of over 3 million HTTP requests, spanning over many different Web agents on the user s local computer, and representing all together 100 million RDF triples and 9GB of data. This particular user makes an active use of the Web not only as part of his personal activities, but also to a large extent in his job as a computer science researcher involved in Semantic Web research. This might explain the surprisingly large amount of requests collected. However, the analyses realized in the next section show that, even though he is a heavy user of the Web, this user s activities do not make appear specific elements that other users would not share. Also, while the size and richness of the data collected makes it fit to the purpose of monitoring and exploring various aspects of the user s online behavior, the scalability of the tool and its ability to process such data in real time represent a major challenge for this work. This is however outside the scope of this paper and will be treated as future work. 4. MONITORING AND ANALYZING VARI- OUS ASPECTS OF PERSONAL WEB AC- TIVITIES Thanks to the technology described above, the user can collect rich, large-scale data about his own activity on the Web. However, collecting raw data is only the first part of the process. In this section, we present some analyses we realize on the basis of this data. Indeed, as shown in our experiment, even the simplest forms of analytics can help the user to better comprehend his own behavior and derive sometimes surprising conclusions. We go a step further and describe in more details the application of new models to assess the perceived trust the user appears to give to various websites, and the different levels of criticality he associates with various pieces of personal data. We also look at what we can learn from investigating the most common activity 2

3 users generally realize on the Web: search. 4.1 Basic Analytics There exist many analytics tool to be used by website administrators to monitor the traffic on there servers. These are based on the logs of accesses to the website (collected locally or through a remote service such as google-analytics.com), to compute various types of statistics. We consider that such statistics could be of value also to a Web user concerning his own Web traffic, inverting the relation and looking at which websites are accessed, as well as at what time most activities happen, where are the destinations of requests and what tools are used to access the Web. Figure 2 shows some of the visualizations that are being computed on the basis of the collected data in our experiment, concerning four basic aspects which we summarize below. Time. The way the amount of Web activity evolves in time for a given user can provide useful indications concerning his own behavior and habits, not only online, but also in connection with other aspects of his life. For example, Figure 2(a) shows the sum of the numbers of Web requests realized over the time of the experiment, according to the time of the day. It therefore represents the typical shape of the user s day on the Web, but more importantly allows to identify common events happening in the user s life during such a typical day. The Web service sleepingtime.org can derive the time in which a user is most likely to be sleeping based on his activity on Twitter. For this particular user, this service returns 12am to 7am 5. We can easily see that this result correlates with the activity graph in Figure 2(a), but also that this graph can be used to identify other common events such as commuting or having dinner. An interesting addition to such an analysis would be to connect these results with the user s calendar, and with a log of his locations (e.g., collected from a GPS-enabled device). Such refinements integrating activity data from various sources and devices will be considered as future work (see Section 5). Location. One of the interesting properties of the Web is that it provides access to information independently from the places where such information physically reside. Nevertheless, the locations of the servers to which Web requests are sent is an interesting information, showing in particular that, however global the Web might be, the user activity tends to concentrate on specific parts of the world. Indeed, looking at Figure 2(b), we can see that, unsurprisingly, most of the requests from the considered user were sent to either Europe (or more specifically the parts of Europe the user relates to: France and the UK) and the US (which host most of the global services used commonly by the user). There are however interesting exceptions to this, including small numbers of requests sent to places such as China, Japan, Alaska or Nigeria. In relation with elements described in the next section concerning trust, in the cases where personal information is being exchanged with particular websites, knowing where they are located could be crucial, as the privacy laws in the places where such critical information is being held can be different from the ones the user would naturally expect to apply considering his European background. 5 on 25/03/2010 (a) (b) (c) (d) Figure 2: Elements of Web Activity Analytics. (a) Sum of the numbers of HTTP Requests per hour of the day over 2.5 months; (b) Location of the servers of accessed websites; (c) Tag Cloud showing the most accessed websites; (d) Distribution of number of requests per agent (y-axis is log scale). 3

4 Popularity. The websites which the user accesses most often i.e., which he finds the most popular would naturally appear as an interesting and straightforward information. However, looking at the tag-cloud like visualization of requests to websites in Figure 2(c), it appears that interpreting the results of such a simple analysis is not as trivial as expected. Indeed, it should first be noted that, in order for this visualization to be readable, two websites were removed from the input data, as they were representing more than 100 times more requests than any of the other websites. These two websites, api.facebook.com and watson.kmi.open.ac. uk represent Web services accessed at regular intervals and to exchange large quantities of data by automatic applications. This also applies to other websites that appear prominently in the visualization, such as search.twitter.com. In addition, the most popular website besides the ones automatically accessed is which is maintained by the user on the basis of an Ajax-based content management system, the high number of requests being therefore more an effect of the technological infrastructure underlying the website, rather than of its popularity (this also applies for example to org). Only once these considerations are taken into account, we can start identifying commonly accessed websites such as or www. neon-project.org. However, another significant exception appears here: Indeed, this represents the most common analytics tool used by many thousands of other websites. The user has never explicitly accessed but only as a side effect of accessing other websites, therefore unknowingly exchanging large quantities of information without having previously given explicit agreement. Agents. Finally, we have already established from above that a large proportion of the user s Web activity occurs without the user even being aware of it. This also transpires when looking at the different tools that access the Web on the user s computer. Indeed, most users would only mention the use of Web browsers to access the Web. However, we found 49 different User-Agents mentioned in our experiment s data, the user s usual Web browser being only the third most active (see Figure 2(d)). Indeed, in accordance with what we discussed above, many applications (such as TweetDeck 6 installed on the user s computer) make automatic accesses to the Web at regular intervals. We can also mention the user s client (getting RSS feeds and images from the Web), automatic update applications, ical (communicating with an online calendar application) and social music applications amongst the most prominent tools contributing to the user s Web traffic. In summary, it appears that even the simplest statistical analyses, such as what presented above, can lead to surprising discovery concerning the user s own Web activity. More importantly, it stresses the fact that Web data exchange is difficult to manage for an individual user, as it happens in a fragmented and partly implicit manner at a large scale. For this reason, the next section focuses on extracting from this data explicit models of the perceived trust given to the accessed websites, and of the criticality of the data exchanged Observing Trust Relationships and Data Criticality As lengthly described in [3], trust is a central element of any social interaction, and therefore, of any exchange on the Web. Indeed, beyond the Web 2.0 emphasis on the Web as a social platform, where people can exchange and share information, experience and more, any communication on the Web appears to be a social interaction between a person (Web user) and a website, which ultimately represents another person, group of persons or organization [2]. Therefore, based on the data collected through our logging mechanism, we consider here a user-centric view on trust in websites (domains) and on the criticality of the data sent to these websites. The intent is to derive from the traces of the user s activity a model of his own trust relationship with the various websites he interacts with. Of course, the data collected using the tool described above contains a lot more information than necessary for this purpose. We therefore extract from this data a subset that corresponds to elements of data that are being sent by the user s Web agents to external websites. We use a simple SPARQL query to obtain the list of requests to which data was attached. This includes HTTP GET requests with parameters (e.g., in search?q=keywords the parameter is q=keyword), as well as HTTP POST requests where the same kind of parameters are enclosed in the content (data) part of the request. As a second step, we use a purpose-built tool to identify personal information in these data transfers. Without going into the details, this tool provides mechanisms for the user to create mappings between the parameters used in particular websites (e.g., and attributes of a very simple model of the user profile (with attributes such as UserName and ). As a result, we obtain a simple model of Web data transfer, where a set of domains d i D (websites) have each received a subset of the set of personal data p i P from the user profile. In our experiment, there were 123 different domains that received data from 36 different attributes in the user profile. Our goal here is, relying on the simple notion of data transfer defined above, to analyse the behavior of the user and derive what is expected to be his implicit trust relationship with the considered websites, and the correlated levels of criticality he seems to associate to each of the considered pieces of data. Crucially, these two notions are highly inter-dependent. Indeed, on the one hand, it is natural for an external observer to assess the trust somebody has in another agent based on the information he is prepared to disclose to this external agent. For example, if I consider my mobile phone number as a critical information, and disclose it to a particular website, this seems to indicate a high level of trust in this particular website. On the other hand, assessing the criticality of a piece of data can be done by considering how much this information is disclosed to external, varyingly trusted agents. The information about my screen resolution for instance might not be considered very critical, since I have provided it to many different website, most of them not very trusted. On the basis of these simple intuitions, we define a measure of the observed trust in a website as the value of the 4

5 Figure 3: Visualization of the observed trust in domains (top) and the observed data criticality (bottom). criticality of the most critical piece of data this website has received. The measure of criticality of a piece of data is designed to be a function of the number and trust values of websites having received this data. Formally, the criticality of a piece of data p i is equal to 1 1+ P d j C(p i ) 1 T (d j ) where C(p i) is the set of domains having received the piece of data p i and T (d j) is the observed trust value for the domain d j. Of course, the measures of trust and criticality being inter-dependent, we treat them as a sequence, calculating itierativly the values of trust at a time t based on the values of criticality at time t 1. Using 0.5 as initial values, these measures converge to a precision of in 285 iterations on our data. Ultimately, the goal of computing the model of observed trust described above is to allow the user to explore it, getting informed about his apparent behavior, and compare this apparent behavior with his own view on trust and data criticality. In other terms, a method to visually explore and interact with the measures of trust and criticality is needed to get the benefit of the observation of Web activity back to the user. We therefore developed a tool (see Figure 3) displaying the observed model of trust in domains and criticality of data using a simple visualization (each bubble represents a value, the bigger and further along the axis the bubble is, the higher the value). Basic interaction mechanisms are also allowed, enabling the user to explore the underlying data (e.g., selecting a piece of data shows to which domains it was sent, therefore providing a justification for the assigned value of criticality), but also to align this perceived model with his own view, for example by dragging a domain bubble towards smaller values, to indicate a lower level of trust in the corresponding website. Such interactions provide simple mechanisms to explore one s own behavior related to trust and data exchange, and possibly detect conflicts in this behavior (i.e., exchanges that would contradict the fundamental assumption that critical data can only be sent to trusted websites). A more complete investigation on applying such a tool for the user to assess his own behavior regarding data exchange and privacy is still needed. However, this has shown very valuable already in identifying interesting, or potentially problematic situations. For example, following from the discussion in the previous section, it appeared that about 50% of the websites having received personal data from the user were unknown to him. Amongst them, many received data having a high level of criticality (e.g., elements of browsing history), while being, according to the user, untrusted or even unknown (e.g., google-analytics.com). This demonstrates the potential of such a tool in making the user aware of his own behavior, supporting him in implementing a more informed management of his own privacy. 4.3 Investigating Search Behavior Searching is one of the most common explicit activity users realize online. As such, in contrast with the elements described in the previous section which looked at implicit models the user might not be aware of, analyzing the way a particular individual makes use of search mechanisms like the ones provided by google.com can help to derive a lot of 5

6 Figure 4: Most commonly searched keywords. information about their conscious behavior, interests, etc. To realize this, we extracted from our activity log data (again using a relatively simple SPARQL query) all the requests that correspond to known search engines (which is made relatively easy by the fact that our user employes almost exclusively the Google search engine, although often in different locations, e.g., google.com, google.co.uk, google.fr). We then parsed these URLs to extract the keywords used, and obtained 709 different queries, representing 456 unique sets of keywords. From this result, we can already identify an interesting phenomenon. Indeed, it appears surprising that such a large proportion of the queries are actually duplicated, and have been re-entered (most of the time in the same search engine) several times over a period of 2.5 months. To better understand this phenomenon, we used the referrer information contained in the request data as stored in our logs to investigate how the user used the results of search. First, it is interesting to notice that only a part (311) of the queries to search engines led to the user following one or more of the results. Out of these 311 unique queries, 231 had only 1 result being used by the user and in 18 of these cases, the same results were followed multiple times (up to 23 times). In contrast, there is not any query in our dataset for which more than 8 different results where actually followed by the user. One way to interpret the elements described above is by considering the way search is used by the user. Indeed, surprisingly, it appears that, in most cases, search is not considered as an exploratory activity by this user, i.e., it is not used with the purpose of discovering resources of interest. Instead, it is used in the majority of the cases (75%) as a way to locate resources that the user knows exist, and has often visited before, but for which he did not record the actual address. In other words, the search engine seems to be used extensively as an index, addressing known websites with keywords, rather than as a way to find out about existing websites. Such behavior has actually been identified in a number of recent studies on repetition in search queries (see for example [5]), showing that navigational search is glob- Figure 5: Terms of interest as extracted from search keywords. The y-axis corresponds to SemanticProxy s measure of relevance. ally becoming a major aspect of the use of search engines, compared to the more traditional informational search [1]. Another element of interest concerning the activity of using a search engine on the Web, is that it can demonstrate particular areas of relevance to the user, which can help better define the user in terms of his interests. First, the tag cloud in Figure 4, generated from the list of search words employed by the user during the considered period, confirms the hypothesis above that many of the uses of search this user is making have for only purpose to retrieve resources that he knows exist (in this case, the user often research the pdf files of his own publications). However, it also makes appear certain keywords that relate to concepts of high relevance to the user, in particular to his job as a computer science researcher, including Java (referring here to the programming language), eclipse (referring to the development environment), AWK (corresponding in this case to the programming language for text processing, which the user was employing extensively during this period), Web, ontology, standard, etc. To deepen this analysis and find broader topics of interests for the user, we experimented with the SemanticProxy 7 service which is part of OpenCalais 8. SemanticProxy analyzes a text to extract from it relevant and important entities, which might not appear explicitly in the text, but be inferred as important concepts based on the content of the text. Using as an input text the list of search queries realized by the user, SemanticProxy detected with 92% confidence that the main topic corresponding to the user s search terms was Technology/Internet. The tool also extracted the set of possible tags that, according to its methods, would best characterize the user search queries: Technology Internet, Portable Document Format, Swoogle, AWK, Computer science, Software engineering, Ontology, Semantic Web, and Computing. Finally, we obtain from the same service a list

7 of generic terms supposedly of interest to the user, ordered according to their assessed levels of relevance (see Figure 5). Despite a few slightly unexpected results, the elements extracted from SemanticProxy are not particularly surprising. However, it is interesting that the search behavior of a user extracted from his activity logs and the use of an openly available tool can characterize the user so well in terms of his interests. While there is not doubt that many online systems employ similar methods to build user profiles to target results (and, in many cases, advertisement), providing such a profile to be exploited by the user himself could be valuable, as it gives additional pointers to resources relating to the extracted topics and could be used to relate with people of similar interests in social applications. 5. DISCUSSION: GOING FURTHER Above, we described the way we collect a semantic record of a user s Web activity, for the purpose of helping this user to better understand his own data exchange and behavior on the Web. Our experiment realized with such a Web activity log collected over a period of 2.5 months shows that this data can effectively be turned into a black box of the user s Web life, helping him in tracking and understanding various types of events for the purpose of personal monitoring, personal information management or privacy. Indeed, we detailed in particular in this paper the analysis of the data collected according to three main aspects: basic analytics showing the time, places, destinations and tools of Web communication, trust and data criticality exposing the user to his own behavior in terms of data exchange, and the use of search as a way to access the Web and to derive information about the user s interest. An interesting element about such analyses is that, with the exception maybe of the trust model, similar studies are usually realized from the perspective of websites, systems or organizations, considering the logs of accesses and interactions of their whole communities of users. In contrast, we show here how some forms of log analysis can be used on a the traces of the user s Web interactions with thousands of websites and services, to be used directly by the user as a way of personal monitoring. To further refine these studies, an obvious next step is to extend them with more ways of investigating the data. Indeed, the collected logs represent large scale, rich information, which representation using semantic technologies makes flexible enough so that a variety of models can be applied to derive more information. We could for example think about analyzing the navigational graph of the user based in the referrer relation recorded as part of the HTTP requests in our logs. It would then be interesting to see if models such as Hub and Authority would apply to such data, therefore showing to the user what are the webpages that are most influential in his Web life. Analyzing the content of such pages would also help in building a more accurate interest profile, compared to what is realized here on the search history. While the data we collected is already very sophisticated and can lead to many more analyses on its own, another interesting further step is to integrate such data with external sources of information. Indeed, some of our tools already require to integrate external information, such as networkbased information and location of servers to build the map of the destinations of Web requests, or the use of available Semantic Web-based text annotation tools for deriving relevant topics to the user s interest, which are directly interlinked with the Web of Data. An additional step in this direction would be to use automatic data linking methods to relate, for example, the identification of the websites accessed or the tools used to their description in DBPedia 9, making possible to automatically categorize these elements and provide further ways to explore the data for the user. Despite the large amounts of data collected in a relatively short period of time, the experiment presented here is limited in the sense that it focuses on one particular user, representing one type of usage of the Web. This helps understanding the types of analysis that can be realized over such data. However, as future work, we plan to investigate comparing the results of the same types of analysis in a group of users of different backgrounds, interests and uses of the Web. This would allow us not only to understand how individual users behave on the Web, but also to see what are the common aspects in their Web lifelogs and how these can be used to relate users with each other. Ultimately, they are many possible ways for the users to exploit these logs for their own purpose, including the possibility to share what they have learnt about themselves within their social network, to make new connections and help other benefit from the analysis of their own interactions with various websites. 6. REFERENCES [1] Andrei Broder. A taxonomy of web search. SIGIR Forum, 36(2):3 10, [2] Robert R. Hoffman, John D. Lee, David D. Woods, Nigel Shadbolt, Janet Miller, and Jeffrey M. Bradshaw. The dynamics of trust in cyberdomains. IEEE Intelligent Systems, 24:5 11, [3] K. O Hara. Trust from Socrates to Spin. Icon Books, [4] K. O Hara, M. Tuffield, and N. Shadbolt. Lifelogging: Privacy and Empowerment with Memories for Life. Identity in the Information Society, 1(2), [5] Mark Sanderson and Susan Dumais. Examining repetition in user search behavior. In Advances in Information Retrieval. 29th European Conference on IR Research, ECIR 2007,