Repository files navigation

Graphameleon is a Web Browser Extension which collects and semantizes Web navigation traces.

Following research on theNORIA-O andDynaGraph projects, the Graphameleon Web extension brings visualization and recording of Web navigation traces at the browser level.Then, leveraging knowledge graph representations, to perform User and Entity Behavior Analytics (UEBA) and Anomaly Detection (AD).

The extension incorporates an internal semantical mapping module that relies on theRMLmapper library to construct a RDF knowledge graph during navigation.Additionally, it utilizes theReact-Force-Graph visualization library, allowing users to view their navigation traces in a 3D representation of the knowledge graph.

You may want to look at theACM SIGWEB/Graphameleon video for an overview of the Graphameleon proposal.See also theTWC2024-Graphameleon-demo.webm video (in thedocs/demo/ folder) for a short demo of how the Graphameleon Web extension works.

If you use this software in a scientific publication, please cite:

Lionel Tailhardat, Benjamin Stach, Yoan Chabot, and Raphaël Troncy. 2024.Graphameleon: Relational Learning and Anomaly Detection on Web Navigation Traces Captured as Knowledge Graphs.In The Web Conference 2024, WWW '24, Singapore, May 13--17, 2024, Proceedings.https://doi.org/10.1145/3589335.3651447

BibTex format:

@inproceedings{graphemeleon-2024,title ={{Graphameleon: Relational Learning and Anomaly Detection on Web Navigation Traces Captured as Knowledge Graphs}},author ={{Lionel Tailhardat} and {Benjamin Stach} and {Yoan Chabot} and {Rapha\"el Troncy}},booktitle ={{The Web Conference 2024, WWW '24, Singapore, May 13--17, 2024, Proceedings}},year ={2024},doi ={10.1145/3589335.3651447}}

🇫🇷 Si vous utilisez ce logiciel dans une publication scientifique, merci de citer :

Lionel TAILHARDAT, Benjamin STACH, Yoan CHABOT, Raphaël TRONCY. 2024.Graphaméléon : apprentissage des relations et détection d’anomalies sur les traces de navigation Web capturées sous forme de graphes de connaissances.In Plate-Forme Intelligence Artificielle (PFIA), IC track, July 01-05, 2024, La Rochelle, France.

Pour une courte démo du fonctionnement de Graphaméléon, vous pouvez consulter la vidéoPFIA2024-Graphameleon-demo.webm (dans le dossierdocs/demo/).

To start using Graphameleon, you have two options:

• Download arelease and unzip it.
• Build the component.

Once you have completed this step, proceed to theRun step described below.

Pre-requisites:

• Downloading and installingNode.js andnpm
• Cloning the repository to your computer
• Installing third-party npm modules:npm install

Create a build forFirefox:

# Firefox is considered to be the browser by default for the build processnpm run start

Create a build forChrome:

npm run start:chrome

Create a build forEdge:

npm run start:edge

Clean the distribution file:

npm run clean

1. First, open a firefox navigation window and go to the following page:about:debugging#/runtime/this-firefox
2. In theTemporary Extensions section, click on theLoad Temporary Add-on... button.
3. Then, select themanifest.json from the./dist or any other file from the same directory to load the extension.

TheGraphameleon Extension is now loaded on Firefox !

1. First, open a chrome navigation window and go to the following page:chrome://extensions/
2. Enable theDeveloper Mode on the top-right corner.
3. Click on theLoad unpacked button.
4. Then, select themanifest.json from the./dist or any other file from the same directory to load the extension.

TheGraphameleon Extension is now loaded on Chrome !

1. First, open an edge navigation window and go to the following page:edge://extensions/](edge://extensions/
2. Enable theDeveloper Mode on the left navigation bar.
3. Click on theLoad unpacked button.
4. Then, select themanifest.json from the./dist or any other file from the same directory to load the extension.

TheGraphameleon Extension is now loaded on Edge !

The general process for performing data capture is as follows:

1. Open the Graphameleon component, this brings a Graphameleon panel
2. Select a capture mode (see table below for details):
   • micro
   • macro
   • hybrid
3. Select a general output format:
   • raw
   • semantize: the data will be mapped according to a RDF data model (ontology);you must then select a mapping definition file inRML syntax (.ttl extension) using theBrowse button.See mapping definition examples in themapping/ folder.
4. Start data capture with theRecord button
5. Navigate the Web in the other Web browser tabs
6. Stop data capture with theStop button from the Graphameleon panel
7. Select a file export format:
   • Raw capture:JSON |CSV
   • Semantize capture:N-Triples |Turtle
8. Export the data with theExport button, the resulting data will be saved in the Web browser's default download folder.

The following table shows the type of data collected by the Graphameleon Web extension as a function of thecapture mode (micro-activityvs macro-activity), and grouped by theirscope (requestvs interactionvs both):

The following class diagram defines the concepts and properties used for the semantic representation ofmicro-activities (left) andmacro-activities (right):

The names of concepts and properties used here are defined within the UCO vocabulary, the following namespaces apply:

• core :https://ontology.unifiedcyberontology.org/uco/core#
• ucobs :https://ontology.unifiedcyberontology.org/uco/observable#
• types :https://ontology.unifiedcyberontology.org/uco/types#

Formicro-activities, the presented classes and properties accurately describe a sequence of requests captured at the Web browser level.

• An HTTP request is represented by an entity of the classucobs:HTTPConnectionFacet, and its headers are represented by specific properties such asucobs:startTime anducobs:endTime for timestamps, andcore:tag forfetch metadata request headers.
• Since an IP address or URL can be common to multiple requests (e.g., a user repeating the same call to a website, a website with various services hosted on the same server), these elements shall be materialized through theucobs:IPAddressFacet anducobs:URLFacet classes respectively, and cross-references between entities is built through properties such asucobs:hasFacet anducobs:host.

Macro-activities further enhance the modeling by allowing the description of interactions.

• We consider the user interactions (e.g., click on a hyperlink, on a Web browser button) asucoact:ObservableAction class instances, with relations to the aboveucobs:HTTPConnectionFacet anducobs:URLFacet entities for describing the context in which they occur.
• Further, we consider thetypes:threadNextItem andtypes:threadPreviousItem properties from UCO for modeling the chronology of activity traces.

Please check thegraphameleon-ds repository for examples of data captured using the Graphameleon Web extension.

📁 graphameleon├───📁 mapping/ <Default semantical mapping rules (RML, YARRRML)>│   └───...├───📁 public/│   ├───📁 assets/ <All assets files>│   │   └───...│   ├───📄 index.html│   ├───📄 manifest.chrome.json <Manifest V3 for Chrome based browsers>│   └───📄 manifest.firefox.json <Manifest V2 for Firefox browser>├───📁 src/ <Extension source code>│   ├───📁 app/ <Application-specific files>│   │   ├───📁 components/ <React UI components and panels>│   │   │   └───...│   │   └───📄 App.jsx <React app>│   ├───📁 scripts/ <Extension scripts (background, content) and modules>│   │   ├───📁 modules/│   │   │   ├───📄 Interaction.js <Interaction collector>│   │   │   ├───📄 Manager.js <Managing communications, collections and mapping>│   │   │   ├───📄 Mapper.js <Mapping management, graph builder>│   │   │   └───📄 Request.js <Request collector>│   │   ├───📁 utils/│   │   │   ├───📄 mapping.js <Raw string default semantical mapping rules (RML)>│   │   │   ├───📄 settings.js <Cross-browser specifiations>│   │   │   └───📄 tools.js <Handcrafted usefull functions>│   │   ├───📄 background.js <Background script: manager, mapper and request collector>│   │   └───📄 content.js <Content script: interaction collectors>│   └───📄 index.jsx└───...

BSD-4-Clause

Copyright (c) 2022-2023,Orange. All rights reserved.

• Benjamin STACH
• Lionel TAILHARDAT
• Yoan CHABOT
• Raphaël TRONCY