How We Saved Cookie Sleuth From False Positive Hell

If you've ever built a privacy tool or security extension, you know the exact moment the dream hits reality: you test your shiny new code on a real-world website, and it immediately blows up.

That was our exact experience with Cookie Sleuth recently. Checkout the Repo here: https://github.com/huement/cookie_sleuth/

We had built an extension designed to catch cookie stuffing—the fraudulent practice where malicious sites covertly drop affiliate tracking cookies onto your browser without your consent so they can steal attribution credit when you buy something later.

The original logic was straightforward: match affiliate URL parameters, check cookie names, add up some penalty points, and flag a threat if the score hit a threshold.

Then we opened YouTube. And Gmail. And a few news sites.

Within seconds, the alert badge turned bright pink with hundreds of false positives. Modern single-page web apps render at lightning speed, make dozens of background API calls, and load programmatic display ads. To our naive scoring engine, YouTube looked like a giant cookie stuffing ring.

We needed to fix this fast. We couldn't just throw together a giant, fragile whitelist. Instead, we re-architected the entire detection engine from the ground up, grounding it in information theory, human physiological reaction limits, and a 3-stage normalized scoring pipeline.

Here is a look behind the scenes at how the new Cookie Sleuth detection engine works.

1. The Core Fix: Moving to a 3-Stage Pipeline

The biggest flaw in our early model was treating affiliate tracking as an automatic threat. Seeing a utm_source= or affid= parameter doesn't mean you're being scammed—it just means affiliate attribution exists.

We completely separated Affiliate Identification from Unsolicited Suspicion. Now, every cookie passes through three distinct stages:

Stage 1: Is this actually an affiliate cookie?

Before running any heavy analysis, Stage 1 performs a quick binary check. Does the cookie name match known affiliate markers? Does the domain belong to an established network like Commission Junction or Impact? Does the URL have referral parameters?

If the answer is no, the engine stops immediately and leaves your CPU alone.

Crucial Add: Stage 1 also includes an immediate filter for programmatic ad-tech exchanges (like DoubleClick, The Trade Desk, or LiveRamp). These platforms sync user IDs across domains constantly. While cross-site ad tracking is a privacy concern, it isn't commission fraud. Suppressing them instantly eliminated a massive chunk of our false positives.

Stage 2: Does the attribution look unsolicited?

If a cookie is affiliate-related, Stage 2 calculates a Normalized Suspicion Score between 0.0 and 1.0 based on six weighted behavioral signals:

• Missing User Intent (30% Weight): Was there an explicit click on the active tab for this domain within the last 4 seconds?
• Delivery Channel (20% Weight): Was the cookie dropped via an invisible background iframe (100% risk) or a client-side script (60% risk)?
• LZ Navigation Novelty (20% Weight): Has the user ever intentionally visited this domain before?
• HTTP 302 Redirect Hop (15% Weight): Was the cookie dropped mid-flight during a silent HTTP redirect chain?
• Early Timing (10% Weight): Did the cookie fire under 500ms from page load?
• Third-Party Context (5% Weight): Does the cookie domain differ from the address bar host?

Stage 3: Bounded Dual-Threshold Verification

Instead of adding arbitrary points together, Stage 2 yields a bounded percentage score from 0 to 100. To trigger a real alert, a cookie must reach a normalized score of 45 or higher.

2. Lempel-Ziv (LZ78) Navigation Novelty

One of the coolest additions to Cookie Sleuth comes straight from the math behind file compression algorithms like .zip and gzip: Lempel-Ziv (LZ78) universal compression.

LZ compressors build an in-memory dictionary of phrases they've already seen. When they encounter familiar data, it's a "hit". When they see brand-new data, it's a "miss" (an entropy spike).

We applied this exact concept to web browsing:

1. The Navigation Dictionary: As you browse, top-level site loads automatically populate your local dictionary with domains you explicitly chose to visit.
2. Dictionary Hit: A site you visited drops an affiliate cookie. Expected behavior.
3. Dictionary Miss (LZ Novelty): A domain you've never visited secretly sets an affiliate cookie. That's an uninvited "miss".

Instead of trying to maintain a giant, outdated blocklist of every rogue affiliate site on the web, LZ Novelty asks a fundamental information-theoretic question: Did the user invite this domain into their browsing history, or is it an uninvited guest?

3. Human Reaction Time & The Early Timing Signal

Here's a simple fact: human beings are slow.

Even the fastest esports pro needs at least 150ms to 200ms just to visually process a page, and several seconds to decide to click a link.

So if a third-party affiliate cookie drops 200ms after you open a website, who clicked the link? You didn't. An automated script or hidden pixel did.

By tracking top-level frame navigation start times down to the exact millisecond, Cookie Sleuth evaluates the elapsed time of every cookie write:

• Fired under 500ms: Automatically flagged for physical impossibility of human interaction (100% timing risk).
• Fired between 500ms and 2,000ms: Scaled down linearly as initial page assets finish rendering.
• Fired after 2,000ms: Zero timing penalty.

4. Smart Modifiers: Discounts & Stealth Boosts

Real-world web traffic is nuanced, so our scoring engine uses dynamic modifiers to adjust threat levels:

• Legitimate Infrastructure Discounts: Trusted web infrastructure—like Google, YouTube, Meta, Cloudflare, or Microsoft—generates lots of complex background requests. We apply a 90% score discount to known infrastructure hosts, completely ending the YouTube/Gmail false positive nightmare.
• User Intent Discounts: If you actually clicked an outbound referral link, that explicit click applies an 80% score discount.
• Retroactive De-risking: If an unvisited domain triggers a low-level alert, but you later choose to visit that domain directly, Cookie Sleuth automatically de-risks the threat and clears the alert icon from your browser.
• Stealth Combination Boosts: When classic cookie stuffing tactics occur together—such as a Hidden Iframe + No Intent + Novel Domain—the engine applies a +25% risk boost to make sure stealth drops never slip under the radar.

5. A Complete Telemetry & UI Overhaul

We didn't just update the background engine—we completely rebuilt the popup interface.

• Toggleable Session Analytics: Switch between a real-time event stream and a detailed analytics view featuring an LZ Novelty Rate gauge and a threat severity breakdown chart.
• Explainable Telemetry Modals: You shouldn't have to guess why a threat was flagged. Clicking on any reason tag inside a threat card opens a mini specification modal that breaks down the exact evaluation weight, category, and security context behind that signal.
• In-App Scoring Rules: We embedded the entire Scoring Spec v3.0 directly into the extension footer so you can inspect the exact rules and thresholds anytime.

What's Next?

By shifting from basic keyword matching to a multi-stage information-theoretic engine, Cookie Sleuth went from noisy and annoying to precise and quiet. It ignores everyday display ads and trusted site features while instantly pinning down real, stealthy cookie stuffing.

Want to inspect the code, run the Vitest suite, or test it against your own lab setup?

Check out the repository on GitHub: https://github.com/huement/cookie_sleuth