IDENTIFYING USER BEHAVIORAL PATTERNS IN WEB BROWSER ACTIVITY USING THE K-NEAREST NEIGHBORS ALGORITHM

B R Kassimova, Aliya Zhetpisbayeva, Leila Rzayeva, Murat Zhakenov, Elzhas Kurmangali, Gul Gabdulualitovna Dzhussupova

Scientific Journal of Astana IT University, 2026

Full text Open access: Gold Metadata (CSL-JSON)
DOI 10.37943/bttb5517
Data confidence 70 medium
How this score is calculated

It is built from checkable properties of the record itself: whether the article has a DOI, how many independent sources confirmed its data, whether the required fields are filled in, and how recent the latest confirmation is. Disagreement between sources and a missing identifier lower it. A value of 80 or above means the record was published without further checking; 60 to 79 means it is published at reduced confidence, with a manual check advisable. A record verified by an editor by hand is never pushed below 90 by a recalculation. This scores our data about the article, not the article itself.

Abstract

The rapid growth of internet usage has significantly increased the volume of digital traces created by users, making web browsers a critical source of evidence in digital forensics. Web browsers store extensive user-related data, including browsing history, search queries, visited domains, cookies, and cache files, which collectively reflect behavioral patterns and decision-making processes. However, existing forensic tools primarily focus on manually extracting and visualizing browser artifacts, providing limited capabilities for automated behavioral analysis. This study addresses this shortcoming by proposing an automated method for identifying and analyzing user behavioral patterns based on web browser activity using machine learning techniques. The proposed approach is based on extracting and structuring browser history data from personal computers, followed by similarity-based classification using the k-nearest neighbors algorithm. Behavioral characteristics are extracted from recurring search queries, domain frequency, and content categories of visited websites, enabling the creation of a structured behavioral dataset. To justify the model selection, the k-nearest neighbors classifier was evaluated alongside logistic regression and Gaussian naive Bayes classifiers using standard performance metrics, including accuracy, precision, recall, F1-score, and area under the curve. Experimental results show that the k-nearest neighbors model achieves the highest recall and F1-score, indicating superior performance in identifying clustered and nonlinear patterns of user behavior compared to the baseline and probabilistic models. The results confirm that similarity-based classification is particularly effective for browser activity analysis, where user actions tend to form localized groups in high-dimensional feature spaces. The proposed method enables the transformation of raw browser data into interpretable user behavior profiles that integrate interests, behavioral indicators, and visit frequency statistics. This improves the practical applicability of web browser analysis by supporting structured behavioral assessment rather than raw data analysis. Overall, the study demonstrates the feasibility and effectiveness of integrating machine learning-based behavioral analysis into web browser forensics workflows and lays the foundation for future research incorporating temporal features, larger datasets, and hybrid learning approaches.