首页之外：测量现场的第三方动态
Beyond the Front Page: Measuring Third Party Dynamics in the Field
摘要：
在现代Web中，服务提供商通常严重依赖第三方来运行其服务。例如，他们利用广告网络为其服务提供资金，利用外部托管的图书馆快速开发功能，利用分析提供商深入了解访问者行为。为了安全和隐私，网站所有者需要了解他们向用户提供的内容。然而，在现实中，他们往往不知道哪些第三方被嵌入，例如，当这些第三方请求额外的内容，因为它是常见的实时广告拍卖。在本文中，我们提出了一个大规模的测量研究，以分析这些新挑战的规模。为了更好地反映第三方的连通性，我们在一个称为第三方树的模型中测量了它们的关系，该模型反映了嵌入到给定网站中的所有第三方的加载依赖关系的近似值。使用这个概念，我们表明，包括一个单一的第三方可以导致随后的请求，从多达8个额外的服务。此外，我们的研究结果表明，嵌入在页面加载的第三方并不总是确定的，因为第三方树中的分支的50%在重复访问之间发生变化。此外，我们发现，93%的分析网站嵌入了位于可能不符合当前法律框架的地区的第三方。我们的研究还复制了以前的工作，主要集中在网站的着陆页。我们表明，这种方法只能测量一个下限，因为子网站显示出显着增加的隐私侵犯技术。例如，我们的结果显示，当更深入地抓取网站时，使用的Cookie增加了约36%。
英文摘要：
In the modern Web, service providers often rely heavily on third parties to run their services. For example, they make use of ad networks to finance their services, externally hosted libraries to develop features quickly, and analytics providers to gain insights into visitor behavior. For security and privacy, website owners need to be aware of the content they provide their users. However, in reality, they often do not know which third parties are embedded, for example, when these third parties request additional content as it is common in real-time ad auctions. In this paper, we present a large-scale measurement study to analyze the magnitude of these new challenges. To better reflect the connectedness of third parties, we measured their relations in a model we call third party trees, which reflects an approximation of the loading dependencies of all third parties embedded into a given website. Using this concept, we show that including a single third party can lead to subsequent requests from up to eight additional services. Furthermore, our findings indicate that the third parties embedded on a page load are not always deterministic, as 50% of the branches in the third party trees change between repeated visits. In addition, we found that 93% of the analyzed websites embedded third parties that are located in regions that might not be in line with the current legal framework. Our study also replicates previous work that mostly focused on landing pages of websites. We show that this method is only able to measure a lower bound as subsites show a significant increase of privacy-invasive techniques. For example, our results show an increase of used cookies by about 36% when crawling websites more deeply.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
