Related papers: SST-Guard: Detecting and Characterizing Server-Side Google Analytics in the Wild

SST-Guard: Detecting and Characterizing Server-Side Google Analytics in the Wild

URL: http://arxiv.org/abs/2604.27497v1
Date: Thu, 30 Apr 2026 06:50:14 GMT
Title: SST-Guard: Detecting and Characterizing Server-Side Google Analytics in the Wild
Abstract summary: We present SST-Guard, a browser-based system for detecting and blocking server-side Google Analytics (sGA)<n>SST-Guard aims to detect underlying artifacts of collection and sharing of these semantic values to any arbitrary endpoint.<n>We validate SST-Guard on Tranco top-10k websites, detecting 4.02% (403) sGA domains with over 93% accuracy across three modalities.
Score: 48.894149803432605
License: http://creativecommons.org/licenses/by/4.0/
Abstract: As web browsers increasingly restrict client-side tracking, the web tracking ecosystem is shifting from client-side to server-side tracking (SST). In SST, the browser sends tracking requests to an intermediate endpoint, which then forwards them to the tracker's endpoint, eliminating direct client-to-tracker requests. As a result, existing tracking protections that block requests to known tracker endpoints are rendered ineffective. In this paper, we investigate server-side implementation of Google Analytics, the most widely deployed third-party tracking service on the web today. We also present SST-Guard, a multi-modal, browser-based system for detecting and blocking server-side Google Analytics (sGA). Our key insight is that even when the tracker's endpoints change, sGA must necessarily still collect and share the same semantic information as client-side Google Analytics (e.g., identifiers, event metadata). Therefore, rather than detecting requests to known Google Analytics endpoints, SST-Guard aims to detect underlying artifacts of collection and sharing of these semantic values to any arbitrary endpoint. Operationalizing this insight is challenging because real-world sGA deployments commonly customize endpoints and obfuscate URLs/payloads. SST-Guard addresses this challenge using a value-template approach that employs regular expressions to match semantic value patterns across multiple modalities: network requests, cookies, and the window object. We validate SST-Guard on Tranco top-10k websites, detecting 4.02\% (403) sGA domains with over 93\% accuracy across three modalities, with network request classifier demonstrating the highest accuracy (99.8\%). By deploying SST-Guard in the wild, we find 4.21\% (6,314) of Tranco top-150k websites using sGA.

Related papers

Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning [67.04448659688579]
FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.<n>Federation is not optional: off-the-shelf transfer collapses under distribution shift.<n>Live FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.
arXiv Detail & Related papers (2026-09-02T07:57:12Z)
From Third-Party to First-Party: Measuring and Protecting Against Modern Web Tracking Mechanisms [0.3914676152740142]
Third-party tracking has always been a cat-and-mouse game between privacy-conscious users and trackers.<n>Recently, this conflict has driven a shift from third-party tracking toward first-party tracking (FPT) and server-side tracking (SST)<n>Despite the growing adoption of these techniques, our understanding of their deployment at scale remains limited.
arXiv Detail & Related papers (2026-06-15T13:49:31Z)
TraceScope: Interactive URL Triage via Decoupled Checklist Adjudication [14.375064108289115]
We present TraceScope, a decoupled triage pipeline that operationalizes this workflow at scale.<n>To prevent the observer effect and ensure safety, a sandboxed operator agent drives a real GUI browser guided by visual motivation to elicit page behavior.<n>An adjudicator agent circumvents LLM context limitations by querying evidence on demand to verify a MITRE ATT&CK checklist, and generates an audit-ready report with extracted indicators of compromise (IOCs)<n>Our evaluation reveals that TraceScope demonstrates superior performance in a real-world scenario as well, successfully detecting sophisticated phishing attempts that current state-of-the-art defenses fail to identify
arXiv Detail & Related papers (2026-04-23T16:31:42Z)
Trackly: A Unified SaaS Platform for User Behavior Analytics and Real Time Rule Based Anomaly Detection [0.22940141855172033]
Trackly unifies comprehensive user behavior analytics with real time, rule based anomaly detection.<n>A real time dashboard provides global session maps, DAU MAU, bounce rates, and session durations.<n>Trackly achieved 98.1% accuracy, 97.7% precision, and 2.25% false positives on synthetic datasets.
arXiv Detail & Related papers (2026-01-30T10:31:26Z)
STAR: Semantic-Traffic Alignment and Retrieval for Zero-Shot HTTPS Website Fingerprinting [8.545240172279017]
STAR learns a joint embedding space for encrypted traffic traces and crawl-time logic profiles.<n>Experiments on 1,600 unseen websites show STAR 87.9 percent top-1 accuracy and 0.963 AUC in open-world detection.
arXiv Detail & Related papers (2025-12-19T15:12:01Z)
OmniTracker: Unifying Object Tracking by Tracking-with-Detection [119.51012668709502]
OmniTracker is presented to resolve all the tracking tasks with a fully shared network architecture, model weights, and inference pipeline. Experiments on 7 tracking datasets, including LaSOT, TrackingNet, DAVIS16-17, MOT17, MOTS20, and YTVIS19, demonstrate that OmniTracker achieves on-par or even better results than both task-specific and unified tracking models.
arXiv Detail & Related papers (2023-03-21T17:59:57Z)
End-to-end Tracking with a Multi-query Transformer [96.13468602635082]
Multiple-object tracking (MOT) is a challenging task that requires simultaneous reasoning about location, appearance, and identity of the objects in the scene over time. Our aim in this paper is to move beyond tracking-by-detection approaches, to class-agnostic tracking that performs well also for unknown object classes.
arXiv Detail & Related papers (2022-10-26T10:19:37Z)
Learning Dynamic Compact Memory Embedding for Deformable Visual Object Tracking [82.34356879078955]
We propose a compact memory embedding to enhance the discrimination of the segmentation-based deformable visual tracking method. Our method outperforms the excellent segmentation-based trackers, i.e., D3S and SiamMask on DAVIS 2017 benchmark.
arXiv Detail & Related papers (2021-11-23T03:07:12Z)
Track to Detect and Segment: An Online Multi-Object Tracker [81.15608245513208]
TraDeS is an online joint detection and tracking model, exploiting tracking clues to assist detection end-to-end. TraDeS infers object tracking offset by a cost volume, which is used to propagate previous object features.
arXiv Detail & Related papers (2021-03-16T02:34:06Z)
A machine learning approach for detecting CNAME cloaking-based tracking on the Web [2.7267622401439255]
We propose a supervised learning-based method to detect machine cloaking-based tracking without the on-demand DNS lookup API. Our goal is to detect both sites and requests linked to cloaking-related tracking. Our evaluation shows that the proposed approach outperforms well-known tracking filter lists.
arXiv Detail & Related papers (2020-09-29T22:33:19Z)
Chained-Tracker: Chaining Paired Attentive Regression Results for End-to-End Joint Multiple-Object Detection and Tracking [102.31092931373232]
We propose a simple online model named Chained-Tracker (CTracker), which naturally integrates all the three subtasks into an end-to-end solution. The two major novelties: chained structure and paired attentive regression, make CTracker simple, fast and effective.
arXiv Detail & Related papers (2020-07-29T02:38:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.