| Traditional web history analysis software, such as MANDIANT's Redline, parses browser history data and produces textual output, often as rows of text in a table. While this method is capable of accurately describing the individual events in a browser history log, it does not lend itself to showing the overall flow of browser activity. Other tools examined perform visualization techniques on history data, showing the amount of activity over time, by category, or by search query, but do not visually reconstruct the flow of events. This paper will present a tool for generating directed graphs based on web history, with the intent of simplifying the reconstruction of a browsing session. These techniques may provide additional insight for existing applications of web history analysis, such as determining the intentions of a user who has arrived at a page with illegal content. By showing the series of pages a user visited before arriving at the illicit page, it may become easier to determine if the user was acting naively or maliciously. Arriving at this information using rows of textual history information is possible, but requires considerable effort to follow the flow of events backwards. Rows of text are not necessarily linked together in order, as the user may have several tabs open, or may use the browser back button to return to a previous page before clicking a new link. |
