Internet Browse Time Reports: How do they work?

Article Number: 000002333
2333
Products: V-Series, Web Security and Filter, Web Security Gateway, Web Security Gateway Anywhere, Websense Enterprise
Versions: All

Problem Description

I need to understand Internet Browse Time Reports, what data they contain and how they work.

Resolution

Calculating a user's Internet browse time is challenging, because it is difficult to determine whether the user is actually reading the page, just opening or closing the browser, performing another task in a different application with the browser open, or possibly away from the desk entirely with the browser open.

 
Websense software makes a reasonable approximation of Internet browse time (IBT) based on:

  • timestamps from Internet requests made as the user browses Web sites
  • the (configurable) Read Time Threshold
  • the (configurable) Last Read Time

Websense reporting tools combine Internet requests into sessions. A session includes all Internet requests from a particular user where the time between any two requests is less than the Read Time Threshold (3 Minutes by default).
 
Reporting tools calculate the time from the first request of the session to the last. Then the Last Read Time is added to determine the Internet Browse Time. For example, suppose a user's browse time session looks like this:
 

5/6/2008 6:05:10 AM http://www.espn.com
5/6/2008 6:05:11 AM http://www.espn.com/index.html
5/6/2008 6:05:11 AM http://www.espn.com/banner.gif
5/6/2008 6:05:11 AM http://www.espn.com/soccer.gif
5/6/2008 6:05:11 AM http://www.espn.com/worldcup.gif
5/6/2008 6:05:30 AM http://www.espn.com/worldcup/outcomes.html
5/6/2008 6:05:31 AM http://www.espn.com/worldcup/2006.gif
5/6/2008 6:05:31 AM
http://www.espn.com/worldcup/2007.gif

 
Actual user's behavior: The user opens the browser and enters www.espn.com at 6:05 on 5/6. One second later, various html objects are downloaded for that site. The user looks at this page for 19 secs, and then clicks the link http://www.espn.com/worldcup/outcomes.html. One second later, more objects are downloaded for that page.
 
Suppose the user reads this page, and then stops making any Internet requests for more than 3 minutes (the duration of the Read Time Threshold). Because this break is larger than the Read Time Threshold, the requests shown above are all considered part of one session.
 
To determine the total time for this session, Websense software calculates the time from the first request (6:05:10) to the last (6:05:31), which is 21 Seconds. Then it adds the Last Read Time (3 Minutes by default) to that time, for a total of 3 Minutes 21 Seconds.


 

You can configure the Read Time Threshold and Last Read Time on the Settings > Reporting > Log Database page in Websense Manager or TRITON - Web Security. (Use the Database Administration utility in the Reporting Tools portal for v6.3.x and earlier.)

Note that a new session is created for the next group of Internet requests made by the same user.

In addition to using the concept of a session, the IBT calculation excludes data collected for categories that generate a lot of superfluous Internet usage data and for protocols other than HTTP and HTTPS.  Browse time calculations also exclude the records generated when a site has been blocked.  This is done in an attempt to make the calculated IBT values as accurate as possible. 

The categories currently not used for IBT calculations are:
* Productivity:  Advertising
* Miscellaneous:  Images (Media)
* Miscellaneous:  Image Servers
* Miscellaneous:  Private IP Addresses
* Miscellaneous:  Content Delivery Networks
* Miscellaneous:  Dynamic Content
* Miscellaneous:  Network Errors

Also, the filters for reports defined to show IBT do not include the categories, protocols or actions that are not used for IBT calculation.  This is also the case when a Browse Time report is used to define a new report.  When a predefined IBT report is selected for editing, the filters are limited to the categories, protocols and actions used for IBT calculation. 

 

Notes & Warnings

Internet Browse Time is NOT based on:

  • When the user's browser is open or closed
  • Bytes sent
  • Bytes received
  • Bytes transferred (this information is based on the size of the files that are downloaded from that site)
  • Duration (which is the amount of time it takes to download the files)
If you see 00:00:00 reported for individual hits, then an embedded link may have been hit once and therefore no browse time captured for that site was recorded. If you are seeing 00:00:00 for “all” browse time, then it is possible that the SQL IBT job has not run yet or that Websense is not receiving information from the integration, for example a PIX or ASA.

Article Rating:

Do you have any additional feedback?    close

How are we doing?

Provide us feedback on your experience with the Service Request portal.

provide feedback >