features.json

{
  "num_updates": 1,
  "num_diffs": 1,
  "per_cookie_features":
  [
    {
      "name" : "top_names",
      "desc" : "One-hot vector where the K-th entry indicates whether the cookie name matches the K-th name. The name ranking is sourced from an external csv file.",
      "function": "feature_top_names",
      "setup": "setup_top_names",
      "source": "resources/top_names.csv",
      "enabled": true,
      "vector_size": 500,
      "args": {}
    },
    {
      "name": "top_domains",
      "desc": "One-hot vector where the K-th entry indicates whether the cookie domain matches the K-th domain. The domain ranking is sourced from an external csv file",
      "function": "feature_top_domains",
      "setup" : "setup_top_domains",
      "source": "resources/top_domains.csv",
      "enabled": true,
      "vector_size": 500,
      "args": {}
    },
    {
      "name": "pattern_names",
      "desc": "One-hot vector where the K-th entry indicates whether the cookie name matches the K-th pattern.\n Pattern cookies are hereby families of cookies originating from the same source which have the same content structure, but have a unique or randomized identifier in their names. \n These identifiers are matched by the regular expression patterns which are sourced from an external csv file.",
      "function": "feature_pattern_names",
      "setup": "setup_pattern_names",
      "source": "resources/cookie_name_patterns.csv",
      "enabled": true,
      "vector_size": 50,
      "args": {}
    },
    {
      "name": "name_tokens",
      "desc": "Binary encoding where the k-th entry indicates whether the kth token appears in the cookie name. \n The terms are hereby selected from the most common english terms observed in cookie names over a separate dataset. This data is sourced from an external text file.",
      "function": "feature_name_tokens",
      "setup": "setup_name_features",
      "source": "resources/name_features_filtered.csv",
      "enabled": true,
      "vector_size": 500,
      "args": {}
    },
    {
      "name": "iab_vendor",
      "desc": "Binary indicator of whether the cookie's domain is part of the IABEurope vendor list. These vendors are third-parties registered with IABEurope's TCF, which may perform data collection on the visitor.",
      "function": "feature_iab_vendor",
      "setup": "setup_iabeurope_vendors",
      "source": "resources/iabeurope_vendors.txt",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "domain_period",
      "desc": "Indicates that a cookie is valid for all subdomains.",
      "function": "feature_domain_period",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "host_only",
      "desc": "Binary indicator feature. Set to 1 if the cookie has the host-only flag set. This flag cannot changed with updates.",
      "function": "feature_host_only_first_update",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "third_party",
      "desc": "Binary feature, set to 1 if cookie's domain does not match the explicitly browsed first-party domain. (i.e. it is a third-party cookie) \n NOTE: This feature may not be viable for real-world application. The problem is that determining third-party status is easy for a crawled dataset, but much harder for data gathered within a browser-extension.",
      "function": "feature_is_third_party",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "non_root_path",
      "desc": "Binary feature. Set to 1 if the cookie's path differs from the default '/' value.",
      "function": "feature_non_root_path",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "update_count",
      "desc": "Ordinal Feature. Counts the total number of updates observed for this cookie. \n NOTE: This feature may not be viable for real-world application. The problem here is that the absolute number of updates grows monotonically as the user browses websites, and eventually exceeds the number of updates observed by the dataset collected in a crawl.",
      "function": "feature_update_count",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "http_only_changed",
      "desc": "Binary feature. Set to 1 if the http_only flag changed between any of the stored updates for this cookie.",
      "function": "feature_http_only_changed",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "secure_changed",
      "desc": "Binary feature. Set to 1 if the 'secure' flag changed between any two updates for this cookie.",
      "function": "feature_secure_changed",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "same_site_changed",
      "desc": "Binary feature. Set to 1 if the 'same_site' flag changed between any two updates for this cookie.",
      "function": "feature_same_site_changed",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "session_changed",
      "desc": "Binary feature. Set to 1 if the 'session' flag changed between any two updates for this cookie. (extremely unlikely)",
      "function": "feature_is_session_changed",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "content_changed",
      "desc": "Binary feature. Set to 1 if the content of the cookie changed between any two updates.",
      "function": "feature_content_changed",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "expiry_changed",
      "desc": "Binary indicator. Set to 1 if the expiration date changed significantly (> 24 hours) between any two consecutive updates.",
      "function": "feature_expiry_changed",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "gestalt_total",
      "desc": "Mean and Standard Deviation of the Gestalt Pattern similarity ratio over all update differences.",
      "function": "feature_gestalt_mean_and_stddev",
      "enabled": true,
      "vector_size": 2,
      "args": {}
    },
    {
      "name": "levenshtein_total",
      "desc": "Mean and Standard Deviation of the Levenshtein Distance between all updates.",
      "function": "feature_levenshtein_mean_and_stddev",
      "enabled": true,
      "vector_size": 2,
      "args": {}
    },
    {
      "name": "contlength_total",
      "desc": "Mean and Standard Deviation of the content length over all updates.",
      "function": "feature_content_length_mean_and_stddev",
      "enabled": true,
      "vector_size": 2,
      "args": {}
    },
    {
      "name":"complength_total",
      "desc": "Mean and Standard Deviation of the zlib compressed content length over all updates. zlib compression is hereby used as a heuristic for entropy, to measure how 'random' the content is.",
      "function": "feature_compressed_length_mean_and_stddev",
      "enabled": true,
      "vector_size": 2,
      "args": {}
    },
    {
      "name": "entropy_total",
      "desc": "Mean and Standard deviation of the Shannon Entropy over all updates.",
      "function": "feature_entropy_mean_and_stddev",
      "enabled": true,
      "vector_size": 2,
      "args": {}
    }
  ],
  "per_update_features":
  [
    {
      "name": "http_only",
      "desc": "Binary Feature. Set to 1 if the http_only flag is set for the update.",
      "function": "feature_http_only",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "secure",
      "desc": "Binary Feature. Set to 1 if the secure flag is set for the update.",
      "function": "feature_secure",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "session",
      "desc": "Binary Feature. Set to 1 if the session flag is set for the update.",
      "function": "feature_session",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "same_site",
      "desc": "One-hot vector. same_site flag may contain the categorical values 'none', 'lax' or 'strict'.",
      "function": "feature_same_site",
      "enabled": true,
      "vector_size": 3,
      "args": {}
    },
    {
      "name": "expiry",
      "desc": "Ordinal Feature. Expiration time in seconds.",
      "function": "feature_expiry",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "expiry_extra",
      "desc": "Binary Vector. Additional checks whether the cookie expires in less than 1 hour, between 1 and 12 hours, between 12 to 24 hours, \n between 1 to 7 days, between 1 week to 1 month, between 1 and 6 months, between 6 and 18 months, and more than 18 months.",
      "function": "feature_expiry_extra",
      "enabled": true,
      "vector_size": 8,
      "args": {}
    },
    {
      "name": "content_length",
      "desc": "Ordinal Feature. Length of the value field of the cookie update.",
      "function": "feature_content_length",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "compressed_length",
      "desc": "Ordinal Feature. Length of the zlib compressed value field of the cookie update. Both compressed size + reduction compared to content length.",
      "function": "feature_compressed_content",
      "enabled": true,
      "vector_size": 2,
      "args": {}
    },
    {
      "name": "shannon_entropy",
      "desc": "Ordinal Feature. Shannon entropy result for the value field of the update.",
      "function": "feature_shannon_entropy",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "url_encoding",
      "desc": "Binary Feature. Whether the value of the cookie update has been URL encoded.",
      "function": "feature_url_encoding",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "delimiter_sep",
      "desc": "Ordinal Feature. Number of CSV separated columns. Uses a predefined set of delimiters. A minimum number of separations is needed for this feature to be extracted. Finally, once a delimiter is chosen, counts the number of columns.",
      "function": "feature_delimiter_separated",
      "enabled": true,
      "vector_size": 9,
      "args": {
        "min_seps": 1
      }
    },
    {
      "name": "base64_encoded",
      "desc": "Try to decode the cookie content as base64 into a UTF-16 string.",
      "function": "feature_base64_encoded",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "contains_js_obj",
      "desc": "Binary Feature. Set to 1 if the cookie update contains a javascript or JSON object.",
      "function": "feature_contains_javascript_object",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "content_eng_terms",
      "desc": "Binary Vector. K-th entry is set to 1 if the k-th term has been found in the cookie value. The terms are sourced from an external file, which has been collected from a set of random cookies.",
      "function": "feature_english_terms_in_content",
      "setup": "setup_content_terms",
      "source": "resources/content_terms_filtered.csv",
      "enabled": true,
      "vector_size": 50,
      "args": {}
    },
    {
      "name": "csv_contents",
      "desc": "Binary Vector. Check if the cookie content is CSV separated, and if so, check if the columns contain numerical, hexadecimal, alphabetical or alphanumerical entries.",
      "function": "feature_csv_content",
      "enabled": true,
      "vector_size": 5,
      "args": {
        "min_seps": 2
      }
    },
    {
      "name": "js_contents",
      "desc": "Binary Vector. Check if the cookie content is a json/javascript object, and check if the elements contain a range of different types of content. \n Includes: Alphabetical, Alphanumerical, hexadecimal, numerical content, 'id' strings, empty content, boolean subobject and lists. Note: does not recursively check subobjects and lists yet.",
      "function": "feature_js_content",
      "enabled": true,
      "vector_size": 11,
      "args": {}
    },
    {
      "name": "numerical_content",
      "desc": "Binary Feature. Set to 1 if the cookie content is a decimal number.",
      "function": "feature_numerical_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "hex_content",
      "desc": "Binary Feature. Set to 1 if the cookie content is a hexadecimal number.",
      "function": "feature_hex_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "alpha_content",
      "desc": "Binary Feature. Set to 1 if the cookie content is entirely alphabetical.",
      "function": "feature_alpha_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "is_identifier",
      "desc": "Binary Feature. Set to 1 if the cookie content is a valid code identifier (no special characters).",
      "function": "feature_is_identifier",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "all_uppercase",
      "desc": "Binary Feature. Set to 1 if all alphabetical characters in the cookie content are uppercase.",
      "function": "feature_all_uppercase_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "all_lowercase",
      "desc": "Binary Feature. Set to 1 if all alphabetical characters in the cookie content are lowercase.",
      "function": "feature_all_lowercase_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "empty_content",
      "desc": "Binary Feature. Set to 1 if the cookie content is empty or whitespace.",
      "function": "feature_empty_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "boolean_content",
      "desc": "Binary Feature. Set to 1 if the cookie content is contained in a set of common boolean identifiers. (include 1, 0, true, false, yes, no etc.)",
      "function": "feature_boolean_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "timestamp_content",
      "desc": "Binary Feature. Set to 1 if the cookie contains a Unix timestamp (second or millisecond) anywhere inside the string.",
      "function": "feature_timestamp_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "date_content",
      "desc": "Binary Feature. Set to 1 if the cookie contains a combination of either date formats, or english month and day strings.",
      "function": "feature_date_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "contains_uuid",
      "desc": "One-hot vector. Check if the cookie contains a UUID of the format {8}-{4}-{4}-{4}-{12} (hex strings), and if so, detects which UUID variant it is.",
      "function": "feature_canonical_uuid",
      "enabled": true,
      "vector_size": 6,
      "args": {}
    },
    {
      "name": "url_content",
      "desc": "Binary Feature. Set to 1 if the cookie contains a URL anywhere in its value field.",
      "function": "feature_url_content",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    }
  ],
  "per_diff_features":
  [
    {
      "name": "time_difference",
      "desc": "Ordinal Feature. Compute the expiration time difference in seconds between updates.",
      "function": "feature_time_diff",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "gestalt_similarity",
      "desc": "Ordinal Feature. Compute the ratio of similarity between consecutive cookie updates based on Gestalt-Pattern matching. \n NOTE: might not be available for the extension.",
      "function": "feature_gestalt_pattern_ratio",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    },
    {
      "name": "lev_distance",
      "desc": "Ordinal Feature. Compute the Levenshtein Distance between consecutive cookie updates.",
      "function": "feature_levenshtein_dist",
      "enabled": true,
      "vector_size": 1,
      "args": {}
    }
  ]
}