Detecting tunneled video streams using traffic analysis

Abstract

Detecting access to video streaming websites is the first step for an organization to regulate unwanted accesses to such sites by its employees. Adversaries often adopt circumvention techniques using proxy servers and Virtual Private Networks (VPNs) in order to avoid such detection. This paper presents a traffic analysis based technique that can detect such tunneled traffic at an organization's firewall using signatures found in traffic amount and timing in targeted video traffic. We present the detection results on the traffic data for several popular video streaming sites. Additional results are presented to validate the detection framework when detecting access to video streaming sites from a wide range of clients with a classifier trained with traffic data collected from a limited number of clients. The results show that the classifier works in both cases. It detects same-client traffic with high true positive rate, while it detects traffic from an unknown client with lower true positive rate but very low false positive rate. The results validate the effectiveness of traffic analysis based detection of video streaming sites.