Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3485447.3512214acmconferencesArticle/Chapter ViewAbstractPublication PagesthewebconfConference Proceedingsconference-collections
research-article
Open access

Reproducibility and Replicability of Web Measurement Studies

Published: 25 April 2022 Publication History

Abstract

Web measurement studies can shed light on not yet fully understood phenomena and thus are essential for analyzing how the modern Web works. This often requires building new and adjusting existing crawling setups, which has led to a wide variety of analysis tools for different (but related) aspects. If these efforts are not sufficiently documented, the reproducibility and replicability of the measurements may suffer—two properties that are crucial to sustainable research. In this paper, we survey 117 recent research papers to derive best practices for Web-based measurement studies and specify criteria that need to be met in practice. When applying these criteria to the surveyed papers, we find that the experimental setup and other aspects essential to reproducing and replicating results are often missing. We underline the criticality of this finding by performing a large-scale Web measurement study on 4.5 million pages with 24 different measurement setups to demonstrate the influence of the individual criteria. Our experiments show that slight differences in the experimental setup directly affect the overall results and must be documented accurately and carefully.

References

[1]
Gunes Acar, Christian Eubank, Steven Englehardt, Marc Juarez, Arvind Narayanan, and Claudia Diaz. 2014. The Web Never Forgets: Persistent Tracking Mechanisms in the Wild. In ACM Conference on Computer and Communications Security(CCS). https://doi.org/10.1145/2660267.2660347
[2]
Shubham Agarwal and Ben Stock. 2021. Critical errors in our recent MADweb paper. https://swag.cispa.saarland/default/2021/07/19/madweb-headers.html
[3]
Shubham Agarwal and Ben Stock. 2021. First, Do No Harm: Studying the manipulation of security headers in browser extensions. In Workshop on Measurements, Attacks, and Defenses for the Web(MADWeb). https://doi.org/10.14722/madweb.2021.23016
[4]
Syed Suleman Ahmad, Muhammad Daniyal Dar, Muhammad Fareed Zaffar, Narseo Vallina-Rodriguez, and Rishab Nithyanand. 2020. Apophanies or Epiphanies? How Crawlers Impact Our Understanding of the Web. In International Conference on World Wide Web(TheWebConf). https://doi.org/10.1145/3366423.3380113
[5]
Alexa Internet, Inc.2021. The Top 500 Sites on the Web. https://www.alexa.com/topsites/
[6]
Mark Alllman and Vern Paxson. 2007. Issues and Etiquette Concerning Use of Shared Measurement Data. In ACM SIGCOMM Internet Measurement Conference(IMC). https://doi.org/10.1145/1298306.1298327
[7]
Waqar Aqeel, Balakrishnan Chandrasekaran, Anja Feldmann, and Bruce M. Maggs. 2020. On Landing and Internal Web Pages: The Strange Case of Jekyll and Hyde in Web Performance Measurement. In ACM SIGCOMM Internet Measurement Conference(IMC). https://doi.org/10.1145/3419394.3423626
[8]
Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. 2022. Dos and Don’ts of Machine Learning in Computer Security. In USENIX Security Symposium(Usenix Sec.).
[9]
Association for Computing Machinery. 2020. Artifact Review and Badging Version 1.1. https://www.acm.org/publications/policies/artifact-review-and-badging-current
[10]
Michael Bailey, David Dittrich, Erin Kenneally, and Doug Maughan. 2012. The Menlo Report. IEEE Security & Privacy 10, 02 (2012). https://doi.org/10.1109/MSP.2012.52
[11]
Sarah Bird, Ilana Segall, and Martin Lopatka. 2020. Replication: Why We Still Can’t Browse in Peace: On the Uniqueness and Reidentifiability of Web Browsing Histories. In Symposium on Usable Privacy and Security(SOUPS).
[12]
Sam Burnett and Nick Feamster. 2015. Encore: Lightweight Measurement of Web Censorship with Cross-Origin Requests. In ACM Conference on Special Interest Group on Data Communication(SIGCOMM). https://doi.org/10.1145/2785956.2787485
[13]
Stefano Calzavara, Tobias Urban, Dennis Tatang, Marius Steffens, and Ben Stock. 2021. Reining in the Web’s Inconsistencies with Site Policy. In Symposium on Network and Distributed System Security(NDSS). https://doi.org/10.14722/ndss.2021.23091
[14]
Darion Cassel, Su-Chin Lin, Alessio Buraggina, William Wang, Andrew Zhang, Lujo Bauer, Hsu-Chun Hsiao, Limin Jia, and Timothy Libert. 2022. OmniCrawl: Comprehensive Measurement of Web Tracking With Real Desktop and Mobile Browsers. Proceedings on Privacy Enhancing Technologies 2, 1(2022).
[15]
cURL Development Team. 2021. cURL – Command Line Tool and Library for Transferring data with URLs. https://curl.se/
[16]
Adrian Dabrowski, Georg Merzdovnik, Johanna Ullrich, Gerald Sendera, and Edgar Weippl. 2019. Measuring Cookies and Web Privacy in a Post-GDPR World. In Conference on Passive and Active Measurement(PAM). https://doi.org/10.1007/978-3-030-15986-3_17
[17]
Maurizio Ferrari Dacrema, Simone Boglio, Paolo Cremonesi, and Dietmar Jannach. 2021. A Troubling Analysis of Reproducibility and Progress in Recommender Systems Research. ACM Transactions on Information Systems 2, 39 (2021).
[18]
Nurullah Demir, Tobias Urban, Kevin Wittek, and Norbert Pohlmann. 2021. Our (in)Secure Web: Understanding Update Behavior of Websites and Its Impact on Security. In Conference on Passive and Active Measurement(PAM). https://doi.org/10.1007/978-3-030-72582-2_5
[19]
Clemens Deußer, Steffen Passmann, and Thorsten Strufe. 2020. Browsing Unicity: On the Limits of Anonymizing Web Tracking Data. In IEEE Symposium on Security and Privacy(S&P). https://doi.org/10.1109/SP40000.2020.00018
[20]
EasyList. 2021. EasyPrivacy. https://easylist.to/easylist/easylist.txt.
[21]
Steven Englehardt and Arvind Narayanan. 2016. Online Tracking: A 1-Million-Site Measurement and Analysis. In ACM Conference on Computer and Communications Security(CCS). https://doi.org/10.1145/2976749.2978313
[22]
Marjan Falahrastegar, Hamed Haddadi, Steve Uhlig, and Richard Mortier. 2016. Tracking Personal Identifiers Across the Web. In pam(PAM). https://doi.org/10.1007/978-3-319-30505-9_3
[23]
Google Inc.2021. BigQuery: Cloud Data Warehouse. https://cloud.google.com/bigquery.
[24]
Google, Inc.2021. Chromium. https://www.chromium.org/Home
[25]
Google, Inc.2021. Fix lazy-loaded content. https://developers.google.com/search/docs/guides/lazy-loading?hl=en
[26]
Jack Hirshleifer. 1980. Privacy: Its Origin, Function, and Future. The Journal of Legal Studies 9, 4 (1980).
[27]
HTTP Archive. 2021. The HTTP Archive Tracks How the Web is Built. https://httparchive.org.
[28]
Xuehui Hu, Guillermo Suarez de Tangil, and Nishanth Sastry. 2020. Multi-country Study of Third Party Trackers from Real Browser Histories. In IEEE European Symposium on Security and Privacy(EuroS&P). https://doi.org/10.1109/EuroSP48549.2020.00013
[29]
Imperva, Inc.2020. Bad Bot Report 2020: Bad Bots Strike Back. https://www.imperva.com/blog/bad-bot-report-2020-bad-bots-strike-back/
[30]
Luca Invernizzi, Kurt Thomas, Alexandros Kapravelos, Oxana Comanescu, Jean-Michel Picod, and Elie Bursztein. 2016. Cloak of Visibility: Detecting When Machines Browse a Different Web. In IEEE Symposium on Security and Privacy(S&P). https://doi.org/10.1109/SP.2016.50
[31]
John Ioannidis. 2005. Why Most Published Research Findings Are False. PLOS Medicine 2, 8 (2005). https://doi.org/10.1371/journal.pmed.0020124
[32]
Umar Iqbal, Peter Snyder, Shitong Zhu, Benjamin Livshits, Zhiyun Qian, and Zubair Shafiq. 2020. AdGraph: A Graph-Based Approach to Ad and Tracker Blocking. In IEEE Symposium on Security and Privacy(S&P). https://doi.org/10.1109/SP40000.2020.00005
[33]
Hugo Jonker, Benjamin Krumnow, and Gabry Vlot. 2019. Fingerprint Surface-Based Detection of Web Bot Detectors. In European Symposium on Research in Computer Security(ESORICS). https://doi.org/10.1007/978-3-030-29962-0_28
[34]
Jordan Jueckstock, Shaown Sarker, Peter Snyder, Aidan Beggs, Panagiotis Papadopoulos, Matteo Varvello, Ben Livshits, and Alexandros Kapravelos. 2021. Towards Realistic and Reproducible Web Crawl Measurements. In International Conference on World Wide Web(TheWebConf). https://doi.org/10.1145/3442381.3450050
[35]
Will Keeling. 2021. selenium-wire 4.3.1. https://pypi.org/project/selenium-wire/.
[36]
George Klees, Andrew Ruef, Benji Cooper, Shiyi Wei, and Michael Hicks. 2018. Evaluating Fuzz Testing. In ACM Conference on Computer and Communications Security(CCS). https://doi.org/10.1145/3243734.3243804
[37]
Pierre Laperdrix, Nataliia Bielova, Benoit Baudry, and Gildas Avoine. 2020. Browser Fingerprinting: A Survey. ACM Transactions on the Web 14, 2 (2020). https://doi.org/10.1145/3386040
[38]
Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczyński, and Wouter Joosen. 2019. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. In Symposium on Network and Distributed System Security(NDSS). https://doi.org/10.14722/ndss.2019.23386
[39]
Bohan Li, Yongxiang Cai, Shuying Deng, and Zongyi He. 2020. The Strategy of Personal Customization and Method of Collecting Professional Dynamic Information. In Journal of Physics: Conference Series(JPCS). https://doi.org/10.1088/1742-6596/1626/1/012034
[40]
Majestic. 2022. The Majestic Million – The million domains we find with the most referring subnets. https://majestic.com/reports/majestic-million/
[41]
Sourena Maroofi, Maciej Korczyński, and Andrzej Duda. 2020. Are You Human? Resilience of Phishing Detection to Evasion Techniques Based on Human Verification. In ACM SIGCOMM Internet Measurement Conference(IMC). https://doi.org/10.1145/3419394.3423632
[42]
Célestin Matte, Nataliia Bielova, and Cristiana Santos. 2020. Do Cookie Banners Respect my Choice? : Measuring Legal Compliance of Banners from IAB Europen’s Transparency and Consent Framework. In IEEE Symposium on Security and Privacy(S&P). https://doi.org/10.1109/SP40000.2020.00076
[43]
Mozilla Foundation,. 2021. OpenWPM on GitHub. https://github.com/mozilla/OpenWPM
[44]
National Academies of Sciences, Engineering, and Medicine. 2019. Reproducibility and Replicability in Science. The National Academies Press, Washington, DC. https://doi.org/10.17226/25303
[45]
Arian Akhavan Niaki, Shinyoung Cho, Zachary Weinberg, Nguyen Phong Hoang, Abbas Razaghpanah, Nicolas Christin, and Phillipa Gill. 2020. ICLab: A Global, Longitudinal Internet Censorship Measurement Platform. In IEEE Symposium on Security and Privacy(S&P). https://doi.org/10.1109/SP40000.2020.00014
[46]
Łukasz Olejnik, Claude Castelluccia, and Artur Janc. 2012. Why Johnny Can’t Browse in Peace: On the Uniqueness of Web Browsing History Patterns. In Proceedings on Privacy Enhancing Technologies(PETS).
[47]
Andriy Panchenko, Fabian Lanze, Jan Pennekamp, Thomas Engel, Andreas Zinnen, Martin Henze, and Klaus Wehrle. 2016. Website Fingerprinting at Internet Scale. In Symposium on Network and Distributed System Security(NDSS). https://doi.org/10.14722/ndss.2016.23477
[48]
Vern Paxson. 2004. Strategies for Sound Internet Measurement. In ACM SIGCOMM Internet Measurement Conference(IMC). https://doi.org/10.1145/1028788.1028824
[49]
James H Price and Judy Murnan. 2004. Research Limitations and the Necessity of Reporting them. American Journal of Health Education 35, 2 (2004).
[50]
Proton Technologies AG. 2021. ProtonVPN: Secure and Free VPN service for protecting your privacy. https://protonvpn.com/
[51]
Paula T Ross and Nikki L Bibler Zaidi. 2019. Limited by our Limitations. Perspectives on Medical Education 8, 4 (2019).
[52]
Christian Rossow, Christian J. Dietrich, Grier Grier, Christian Kreibich, Vern Paxson, Norbert Pohlmann, Herbert Bos, and Maarten van Steen. 2012. Prudent Practices for Designing Malware Experiments: Status Quo and Outlook. In IEEE Symposium on Security and Privacy. https://doi.org/10.1109/SP.2012.14
[53]
Patrick E. Shrout and Joseph L. Rodgers. 2018. Psychology, Science, and Knowledge Construction: Broadening Perspectives from the Replication Crisis. Annual Review of Psychology 69, 1 (2018). https://doi.org/10.1146/annurev-psych-122216-011845
[54]
Software Freedom Conservancy. 2021. SeleniumHQ Browser Automation. https://www.selenium.dev/.
[55]
Tobias Urban, Martin Degeling, Thorsten Holz, and Norbert Pohlmann. 2020. Beyond the Front Page: Measuring Third Party Dynamics in the Field. In International Conference on World Wide Web(TheWebConf). https://doi.org/10.1145/3366423.3380203
[56]
Tobias Urban, Dennis Tatang, Martin Degeling, Thorsten Holz, and Norbert Pohlmann. 2020. Measuring the Impact of the GDPR on Data Sharing. In ACM Asia Conference on Computer and Communications Security(AsiaCCS). https://doi.org/10.1145/3320269.3372194
[57]
Erik van der Kouwe, Gernot Heiser, Dennis Andriesse, Herbert Bos, and Cristiano Giuffrida. 2019. SoK: Benchmarking Flaws in Systems Security. In IEEE European Symposium on Security and Privacy(EuroS&P). https://doi.org/10.1109/EuroSP.2019.00031
[58]
Benjamin VanderSloot, Allison McDonald, Will Scott, J. Alex Halderman, and Roya Ensafi Ensafi. 2018. Quack: Scalable Remote Measurement of Application-Layer Censorship. In USENIX Security Symposium(Usenix Sec.).
[59]
Antoine Vastel, Walter Rudametkin, Romain Rouvoy, and Xavier Blanc. 2020. FP-Crawlers: Studying the Resilience of Browser Fingerprinting to Block Crawlers. In Workshop on Measurements, Attacks, and Defenses for the Web(MADWeb). https://doi.org/10.14722/madweb.2020.23010
[60]
David Y. Wang, Stefan Savage, and Geoffrey M. Voelker. 2011. Cloak and Dagger: Dynamics of Web Search Cloaking. In ACM Conference on Computer and Communications Security(CCS). https://doi.org/10.1145/2046707.2046763
[61]
Peter Wurzinger, Christian Platzer, Christian Ludl, Engin Kirda, and Christopher Kruegel. 2009. SWAP: Mitigating XSS Attacks Using a Reverse Proxy. In ICSE Workshop on Software Engineering for Secure Systems(IWSESS). https://doi.org/10.1109/IWSESS.2009.5068456
[62]
Zhiju Yang and Chuan Yue. 2020. A Comparative Measurement Study of Web Tracking on Mobile and Desktop Environments. In Proceedings on Privacy Enhancing Technologies(PETS). https://doi.org/10.2478/popets-2020-0016
[63]
David Zeber, Sarah Bird, Camila Oliveira, Walter Rudametkin, Ilana Segall, Fredrik Wollsén, and Martin Lopatka. 2020. The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing. In International Conference on World Wide Web(TheWebConf). https://doi.org/10.1145/3366423.3380104

Cited By

View all
  • (2024)Evaluating the Impact of Design Decisions on Passive DNS-Based Domain Rankings2024 8th Network Traffic Measurement and Analysis Conference (TMA)10.23919/TMA62044.2024.10559182(1-11)Online publication date: 21-May-2024
  • (2024)Integrating measures of replicability into scholarly search: Challenges and opportunitiesProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3643043(1-18)Online publication date: 11-May-2024
  • (2024)Automating Website Registration for Studying GDPR ComplianceProceedings of the ACM Web Conference 202410.1145/3589334.3645709(1295-1306)Online publication date: 13-May-2024
  • Show More Cited By

Index Terms

  1. Reproducibility and Replicability of Web Measurement Studies
              Index terms have been assigned to the content through auto-classification.

              Recommendations

              Comments

              Information & Contributors

              Information

              Published In

              cover image ACM Conferences
              WWW '22: Proceedings of the ACM Web Conference 2022
              April 2022
              3764 pages
              ISBN:9781450390965
              DOI:10.1145/3485447
              Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

              Sponsors

              Publisher

              Association for Computing Machinery

              New York, NY, United States

              Publication History

              Published: 25 April 2022

              Permissions

              Request permissions for this article.

              Check for updates

              Author Tags

              1. Web measurements
              2. privacy
              3. replicability
              4. reproducibility
              5. security

              Qualifiers

              • Research-article
              • Research
              • Refereed limited

              Conference

              WWW '22
              Sponsor:
              WWW '22: The ACM Web Conference 2022
              April 25 - 29, 2022
              Virtual Event, Lyon, France

              Acceptance Rates

              Overall Acceptance Rate 1,899 of 8,196 submissions, 23%

              Contributors

              Other Metrics

              Bibliometrics & Citations

              Bibliometrics

              Article Metrics

              • Downloads (Last 12 months)485
              • Downloads (Last 6 weeks)43
              Reflects downloads up to 03 Oct 2024

              Other Metrics

              Citations

              Cited By

              View all
              • (2024)Evaluating the Impact of Design Decisions on Passive DNS-Based Domain Rankings2024 8th Network Traffic Measurement and Analysis Conference (TMA)10.23919/TMA62044.2024.10559182(1-11)Online publication date: 21-May-2024
              • (2024)Integrating measures of replicability into scholarly search: Challenges and opportunitiesProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3643043(1-18)Online publication date: 11-May-2024
              • (2024)Automating Website Registration for Studying GDPR ComplianceProceedings of the ACM Web Conference 202410.1145/3589334.3645709(1295-1306)Online publication date: 13-May-2024
              • (2024)SoK: Prudent Evaluation Practices for Fuzzing2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00137(1974-1993)Online publication date: 19-May-2024
              • (2024)To Auth or Not To Auth? A Comparative Analysis of the Pre- and Post-Login Security Landscape2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00094(1500-1516)Online publication date: 19-May-2024
              • (2024)SoK: SSO-MONITOR - The Current State and Future Research Directions in Single Sign-on Security Measurements2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)10.1109/EuroSP60621.2024.00018(173-192)Online publication date: 8-Jul-2024
              • (2023)Analyzing YouTube Content: Methodological Considerations for Technical Communication ResearchProceedings of the 41st ACM International Conference on Design of Communication10.1145/3615335.3623005(18-25)Online publication date: 26-Oct-2023
              • (2023)Analyzing Cyber Security Research Practices through a Meta-Research FrameworkProceedings of the 16th Cyber Security Experimentation and Test Workshop10.1145/3607505.3607523(64-74)Online publication date: 7-Aug-2023
              • (2023)Unveiling the Impact of User-Agent Reduction and Client Hints: A Measurement StudyProceedings of the 22nd Workshop on Privacy in the Electronic Society10.1145/3603216.3624965(91-106)Online publication date: 26-Nov-2023
              • (2023)Load-and-Act: Increasing Page Coverage of Web ApplicationsInformation Security10.1007/978-3-031-49187-0_9(163-182)Online publication date: 15-Nov-2023
              • Show More Cited By

              View Options

              View options

              PDF

              View or Download as a PDF file.

              PDF

              eReader

              View online with eReader.

              eReader

              HTML Format

              View this article in HTML Format.

              HTML Format

              Get Access

              Login options

              Media

              Figures

              Other

              Tables

              Share

              Share

              Share this Publication link

              Share on social media