Towards understanding upstream Web traffic

While downstream Web traffic has been studied in detail, upstream Web traffic has not received much attention yet. We argue that upstream traffic deserves the same or even higher attention since data flows towards Web servers generally entail privacy-relevant user information. Our aim is to understand where to and how much data users send to Web services. To this end, we examine HTTP(S) requests of two 24 hour traces recorded at a gateway of a campus network. As HTTP is highly repetitive, we introduce a scalable approach to remove redundant parts from upstream Web traffic, yielding an approximation of actual information flow. We identify thirteen classes of Web services covering up to 95% of all outgoing HTTP information. Our methodology further allows to quantify and compare the share of information different Web service classes receive. We find that advertisement and analytics services receive two times more information during Web browsing than all first party Web services together.