Video streams continue to dominate network traffic. Regulating video traffic is crucial because some videos may contain malicious content that harms society. The key foundation of regulation is identifying encrypted video traffic, primarily based on fingerprinting techniques. However, QUIC is becoming a mainstream video transport protocol similar to TCP, and its end-to-end encryption renders traditional packet-based fingerprint extraction methods ineffective. Besides, unstable network environments can lead to video data loss or retransmissions, disrupting fingerprint continuity and, thus, the effectiveness of identification. Furthermore, with ongoing booming video numbers, deep learning-based algorithms display poor real-time identification capability because they require extensive training resources and time to learn new video patterns every time. To address these challenges, we propose a two-stage encrypted video traffic identification method, TSIV. We designed a fingerprint extraction method for QUIC encrypted traffic relying on the flow feature. Additionally, we developed Hit Model based on Term Frequency-Inverse Document Frequency (TF-IDF) and Corrective Dynamic Time Wrapping (C-DTW) to perform the two-stage fingerprint matching, considering both the distribution and temporal sequence characteristics of video data, to handle potential issues caused by fingerprint discontinuity. The experimental results demonstrate that TSIV significantly improves accuracy and speed under ideal and poor conditions, outperforming existing methods.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

TSIV: A Two-Stage Approach for Identifying Encrypted Video Traffic in Unstable Network

  • Die Hu,
  • Jingguo Ge,
  • Tong Li,
  • Hui Li,
  • Liangxiong Li,
  • Weitao Tang

摘要

Video streams continue to dominate network traffic. Regulating video traffic is crucial because some videos may contain malicious content that harms society. The key foundation of regulation is identifying encrypted video traffic, primarily based on fingerprinting techniques. However, QUIC is becoming a mainstream video transport protocol similar to TCP, and its end-to-end encryption renders traditional packet-based fingerprint extraction methods ineffective. Besides, unstable network environments can lead to video data loss or retransmissions, disrupting fingerprint continuity and, thus, the effectiveness of identification. Furthermore, with ongoing booming video numbers, deep learning-based algorithms display poor real-time identification capability because they require extensive training resources and time to learn new video patterns every time. To address these challenges, we propose a two-stage encrypted video traffic identification method, TSIV. We designed a fingerprint extraction method for QUIC encrypted traffic relying on the flow feature. Additionally, we developed Hit Model based on Term Frequency-Inverse Document Frequency (TF-IDF) and Corrective Dynamic Time Wrapping (C-DTW) to perform the two-stage fingerprint matching, considering both the distribution and temporal sequence characteristics of video data, to handle potential issues caused by fingerprint discontinuity. The experimental results demonstrate that TSIV significantly improves accuracy and speed under ideal and poor conditions, outperforming existing methods.