PaperlayerView exact revision on arXiv

Source-linked AI summary

Behavioral Fingerprinting and Navigation Prediction in Web Browsing

Ralph Elsaghbini, Omran Berjawi, Walid Fahs, Rida Khatoun

arXiv:2609.18273v1cs.LG

TL;DR

The paper asks how much short browsing traces reveal about user identity and future navigation, given that prior work often treats these tasks separately. It compares classical, neural, graph-based, sequential, and LLM-augmented models in a shared but task-specific framework. Results indicate that repeated user–domain interaction structure dominates both identifiability and predictability, while LLM semantic features add only limited information.

  • Problem

    Prior research typically studies browsing identifiability and predictability independently under differing temporal and methodological choices, limiting direct comparison of their underlying behavioral structure.

  • Method

    The paper conducts controlled experiments on two tasks using a common event stream and task-specific preprocessing, evaluating classical, neural, graph-based, sequential, and LLM-augmented models.

  • Results

    Repeated user–domain interaction structures provide the dominant signal for both user identification and navigation prediction, while LLM-derived semantic augmentation yields only marginal additional benefit.

  • Takeaways & Limitations

    Identity-related and predictive signals in browsing traces appear strongly influenced by similar interaction regularities, with structural and sequential information outweighing evaluated semantic features.

  • Takeaways & Limitations

    The identification evaluation uses a stratified random user split rather than a strictly temporal split, so its result should be interpreted as an upper bound.

Abstract

from arXiv · show

Web browsing often appears ephemeral: users visit a few websites, complete a task, and move on. However, even short fragments of browsing activity can contain rich and structured behavioral signals. In this work, we conduct a comparative empirical study of two complementary behavioral inference tasks: session-level user identification and next-domain prediction. Both tasks are derived from the same cleaned event stream and evaluated on large-scale anonymous browsing traces, with sessionization and splitting adapted to the temporal requirements of each task. For user identification, we evaluate classical and neural models operating on session-level behavioral and domain features. For next-domain prediction, we combine graph-based modeling with Large Language Models (LLMs). Experimental results show that short browsing sessions are highly identifiable, while future navigation actions are highly predictable from long-term interaction structure combined with recent behavioral context. Furthermore, LLM-derived semantic features yield only marginal gains over purely structural and sequential models, indicating that repeated interaction patterns remain the dominant predictive signal in the evaluated web-browsing setup. These findings highlight the extent to which interaction history substantially contributes to both user identifiability and navigation predictability in browsing traces.

I. INTRODUCTION

Web browsing traces contain structured signals despite short, disconnected sessions, motivating two complementary tasks: identifying users from sessions and predicting their next domains. The paper compares modeling families under a shared framework to examine how interaction structure supports both inferences.

  • I. INTRODUCTION: Short browsing activity can encode user identity because browsing behavior exhibits regularities arising from habits and repeated website visits.These regularities make seemingly noisy or ephemeral traces behaviorally structured.
  • I. INTRODUCTION: Prior work typically studies identifiability and predictability separately, using different temporal scales and methodological choices such as sessionization and splitting.This separation makes it difficult to determine how much observed structure reflects underlying behavioral regularities.
  • I. INTRODUCTION: The paper evaluates classical, neural, graph-based, and LLM-augmented models within a consistent experimental pipeline.The framework uses task-specific processing while enabling comparison of modeling families over related browsing signals.
  • I. INTRODUCTION: The study jointly examines session-level user identification and next-domain prediction as complementary behavioral inference tasks.Both tasks are derived from web browsing traces and address identity-related and future-navigation structure.
  • I. INTRODUCTION: The study analyzes structural interaction patterns and quantifies how LLM-based semantic augmentation contributes across the two tasks.Its contributions explicitly target the role of interaction structure and the marginal value of semantic features.

II. RELATED WORK

Related work establishes that browsing behavior is regular, predictable, and potentially identifying, while emphasizing that results depend on modeling and preprocessing choices. The paper builds on sequential, structural, and interaction-based approaches through controlled comparison across behavioral inference tasks.

  • II. RELATED WORK: Browsing behavior exhibits stable routines and repeated domain visits, supporting both predictability and identification from partial traces.Prior studies connect repeated habits with online predictability and show that browsing history can serve as a fingerprint.
  • II. RELATED WORK: Findings on browsing predictability are sensitive to session identification, preprocessing, and feature representation choices.This methodological dependence motivates controlled comparison rather than treating results from different protocols as directly interchangeable.
  • II. RELATED WORK: Next-action prediction has progressed from Markov and recurrent models toward attention and Transformer architectures for longer-range dependencies.More complex architectures do not necessarily improve performance.
  • II. RELATED WORK: Interaction-focused methods capture higher-order activity patterns and long-term preferences, indicating that browsing behavior has multi-scale structure.Motifs and multi-session representation learning complement immediate sequential dependencies.
  • II. RELATED WORK: This work compares classical, graph-based, neural sequence, and LLM models to analyze how they capture regularities in browsing traces.The comparison connects prediction-oriented and identification-oriented research within one empirical study.

III. BEHAVIORAL MODELING FRAMEWORK

The framework represents browsing as temporally ordered user–domain interactions containing persistent preferences and transient session context. It evaluates identity inference from short sessions alongside next-domain prediction from recent sequences and long-term interaction history.

  • III. BEHAVIORAL MODELING FRAMEWORK: Browsing traces are modeled as temporally ordered user–domain events combining persistent user-specific patterns with transient contextual dynamics.Persistent structure reflects repeated preferences, while transient structure influences immediate navigation decisions.
  • III. BEHAVIORAL MODELING FRAMEWORK: Sessions are contiguous activity episodes formed using a time-gap rule and represented as ordered domain sequences.Each session captures both habitual behavior and immediate intent.
  • III. BEHAVIORAL MODELING FRAMEWORK: Session-level user identification infers the generating user from a short browsing session, measuring how strongly persistent signatures appear in limited observations.High performance indicates that user-specific preferences are encoded in short activity fragments.
  • III. BEHAVIORAL MODELING FRAMEWORK: Next-domain prediction infers the next domain from a user and a recent sequence, combining short-term navigation context with long-term interaction history.The task targets immediate navigation dynamics rather than identity alone.

C. Modeling Approaches

The modeling approaches represent session identity through fixed-dimensional behavioral and domain features, while SD-HBM combines graph-based long-term structure, GRU sequence context, temporal signals, and LLM-derived semantics. These representations are fused to score candidate next domains.

  • C. Modeling Approaches: Session identification uses fixed-dimensional behavioral, domain, and demographic features with linear, tree-based, neural, and representation-learning classifiers.The models estimate p(u | S) and assess how identity information is preserved across feature and representation choices.
  • C. Modeling Approaches: SD-HBM models next-domain prediction on a weighted user–domain bipartite graph, using log-scaled interaction frequencies to preserve preferences while limiting repetitive-visit influence.The graph is G = (U ∪ D, E), with w(u, d) = log(1 + count(u, d)).
  • C. Modeling Approaches: A two-layer GraphSAGE encoder captures long-term interests through direct and higher-order shared-domain connectivity.Users with overlapping visited-domain sets are placed closer in the learned embedding space.
  • C. Modeling Approaches: A GRU encoder summarizes the most recent L domains and incorporates hour-of-day, day-of-week, and last-domain information for temporal navigation modeling.These signals represent short-term dependencies and transition patterns within sessions.
  • C. Modeling Approaches: LLM-derived descriptors summarize behavioral categories, diversity, routine strength, and category affinities as semantic features complementing structural and sequential signals.The descriptors are extracted from the learned graph-based user embedding under a constrained structured prompt.
  • C. Modeling Approaches: SD-HBM concatenates graph, sequential, temporal, last-domain, and semantic representations before a feed-forward prediction head scores candidate domains.The graph encoder is pretrained and frozen before training the sequence prediction head.

IV. EXPERIMENTAL SETUP

The experiments use a large anonymous web-browsing dataset containing time-stamped sessions from over two thousand users. After filtering incomplete records, the analysis retains more than nine million domain-level browsing events.

  • The dataset contains user identifiers, visited domains, timestamps, and active session durations collected over about one month.
  • Demographic features and a domain-to-category map support session-based identification features but are excluded from future-information construction for prediction.
  • More than nine million browsing events from over two thousand users remain after incomplete records are removed.The released data uses opaque panel identifiers and excludes URLs, page content, and directly identifying attributes.

B. Preprocessing and Session Construction

The common pipeline cleans and chronologically orders events, then constructs sessions with task-specific inactivity thresholds. Identification uses short session fragments, while next-domain prediction uses sliding windows over a restricted domain vocabulary.

  • B. Preprocessing and Session Construction: A new session begins when consecutive events for a user are separated by more than threshold ∆, producing temporally coherent sequences.
  • B. Preprocessing and Session Construction: Identification selects a 2-second threshold to preserve fine-grained behavioral fragments, whereas prediction tests gaps from 2 to 120 seconds.
  • B. Preprocessing and Session Construction: Thresholds were chosen during exploratory pipeline development and fixed before model training rather than tuned on reported test results.
  • B. Preprocessing and Session Construction: Identification sessions encode activity, temporal, repetition, cross-session, domain, and demographic features for multi-class user classification.
  • B. Preprocessing and Session Construction: Prediction samples use sliding windows over prior L events, retain only the top K domains, map the remainder to UNK, and require sessions longer than L events.This setup characterizes sustained browsing episodes rather than the full session population.

1) Task 1: Session-Level User Identification:

The study compares classical, neural, graph-based, and LLM-augmented approaches for behavioral inference, including a structure-dominant hybrid model for next-domain prediction. Evaluation uses Top-1 accuracy, a strict criterion over large user and domain label spaces, while richer ranking metrics are left for future work.

  • 1) Task 1: Session-Level User Identification:: SD-HBM extends GSM with LLM-based semantic feature augmentation for next-domain prediction.
  • 1) Task 1: Session-Level User Identification:: GSM learns graph embeddings and recent-sequence representations, while SD-HBM fuses these structural and sequential signals with semantic features.The model combines graph-based user and domain representations with a GRU over recent visited domains and contextual embeddings.
  • 1) Task 1: Session-Level User Identification:: The comparison includes GBM, GSM, and GSM + LLM Reranking under the same experimental setting as SD-HBM.
  • 1) Task 1: Session-Level User Identification:: Top-1 accuracy measures the ratio of correctly predicted labels to all evaluated samples, with N denoting the total sample count.
  • 1) Task 1: Session-Level User Identification:: Top-1 accuracy is strict because identification has 2,140 user classes and prediction has 10,001 classes; Recall@k and mean reciprocal rank are not reported.

F. Evaluation Protocol

The evaluation protocol is designed to limit temporal and structural leakage while keeping model comparisons consistent. Prediction uses chronological splits and training-only graphs, whereas identification uses a stratified random split that is not chronological.

  • F. Evaluation Protocol: Next-domain prediction trains on earlier sessions and evaluates on later sessions using chronological per-user splits.
  • F. Evaluation Protocol: Identification uses a stratified random split over users, so sessions close in time may appear on opposite sides of the partition.
  • F. Evaluation Protocol: Navigation graphs are constructed solely from training sessions, with no test-time interactions included.
  • F. Evaluation Protocol: Session-level features use only events within the session and preceding sessions, excluding activity occurring later in the user trace.
  • F. Evaluation Protocol: All statistical, neural, graph-based, and LLM-based approaches are evaluated on the same test splits.

V. EXPERIMENTAL RESULTS

Short browsing sessions are strongly identifiable, while next-domain prediction benefits from combining long-term interaction structure with recent behavioral context. LLM-based semantic features provide only small gains, leaving graph and sequential interaction patterns as the dominant signal.

  • Session-Level User Identification: 89.8% Top-1 accuracy from the MLP shows that short browsing sessions can identify users, outperforming tree models at 84.8% and linear models at 30.5%.The identity signal emerges from interactions among behavioral, domain, and demographic features rather than from one individual feature.
  • Next-Domain Prediction: 79.38% accuracy from GSM shows that combining long-term structural embeddings with short-term sequential modeling improves next-domain prediction.The graph-based baseline already captures repeated navigation through persistent user–domain structure and recent behavioral context.
  • Next-Domain Prediction: 80.15% accuracy is achieved by SD-HBM, exceeding GSM at 79.38% and LLM reranking at 79.84% for next-domain prediction.The results compare graph-based, sequential, and LLM-enhanced models, with feature augmentation outperforming post-hoc reranking.
  • LLM Augmentation: LLM components yield small, consistent gains over GSM, with reranking at 79.84% and SD-HBM at 80.15%.Semantic features are complementary, but the dominant predictive signal remains in the interaction graph and recent behavioral sequences.

VI. DISCUSSION

Repeated interaction patterns dominate both user identification and next-domain prediction, while semantic augmentation contributes only marginal information. The discussion also bounds these findings by dataset, representation, evaluation, sessionization, sampling, training, feature, and modeling constraints.

  • VI. DISCUSSION: Repeated user–domain interactions are the dominant signal across both tasks, supporting a shared interaction structure for identity inference and navigation prediction.Structural representations capture stable identity-related and short-term predictive information within the same representational space.
  • VI. DISCUSSION: Most exploitable browsing structure is captured by interaction history and temporal ordering, with sequential modeling refining rather than transforming structural predictive capacity.
  • VI. DISCUSSION: LLM-derived semantic features add only marginal information beyond interaction patterns, refining rather than transforming the underlying representation.
  • VII. LIMITATIONS: The findings are limited by a single short-period dataset, domain-level records, and task-specific evaluation protocols that restrict generalization and direct temporal comparability.Identification uses a stratified random partition and should be read as an upper bound, while next-domain prediction uses chronological splitting.
  • VII. LIMITATIONS: A 2-second session threshold can capture page-loading footprints alongside user choices, so identification at this resolution is not purely navigational.
  • VII. LIMITATIONS: Next-domain predictability is characterized only for sessions longer than L events, while compression effects are unmeasured because the autoencoder uses one latent size.
  • VII. LIMITATIONS: Single training runs, absent trivial baselines, demographic features, and untested preprocessing choices make close model orderings and purely behavioral accuracy uncertain.Sub-one-point differences among the strongest next-domain models may reflect run-to-run variation.

VIII. CONCLUSION

This study examines user identifiability and navigation predictability as complementary inference tasks using a common framework for web-browsing traces. It finds that interaction history and repetition patterns govern both tasks, while semantic interpretations play a secondary role.

  • VIII. CONCLUSION: Both identity inference and next-action prediction are largely governed by repeated interaction patterns within user–domain behavior.
  • VIII. CONCLUSION: Semantic interpretations play a secondary role, while identity-related and predictive signals appear strongly influenced by similar interaction regularities.
Loading 2609.18273v1…