ITP-knn: Encrypted video flow identification based on the intermittent traffic pattern of video and k-nearest neighbors classification

Abstract

As video dominates internet traffic, researchers tend to pay attention to video-related fields, such as video shaping, differentiated service, multimedia protocol tunneling detection. Some video-related fields, e.g., traffic measurement and the metrics for Quality of Experience, are based on video flow identification. However, video flow identification faces challenges. Firstly, the increasing adoption of Transport Layer Security makes payload-based methods no longer applicable. Secondly, traffic features differ when generated by different streaming protocols. This paper proposes a video flow identification method, called ITP-KNN, which utilizes the intermittent traffic pattern-related features (ITP) and the K-nearest neighbors (KNN) algorithm. The intermittent traffic pattern is caused by fragmented transmission, which is common among video streamings generated by different streaming protocols. Therefore, the intermittent traffic pattern is useful for overcoming the above challenges and then differentiating video traffic from not-video traffic. We develop a set of features to describe the intermittent traffic pattern. Preliminary results show the promise of ITP-KNN, yielding high identification recall and precision over a range of video content and encoding qualities.