Protocol-independent identification of encrypted video traffic sources using traffic analysis

Abstract

This paper presents a mechanism to use Traffic Analysis (TA) for identifying sources of tunneled video streaming traffic. The key idea is to probe encrypted and tunneled video streaming traffic at a client-side firewall so that the firewall can identify the traffic source using traffic analysis, and block or throttle traffic from that particular source. The key contribution in this paper is to evaluate Packet Arrival Interval (PAI) as a classification feature for identifying sources of tunneled video streaming traffic. Using OpenVPN servers for creating encryption tunnels, experiments are conducted for a large number of popular video steaming servers and multiple client devices located in different geographical locations. It was experimentally demonstrated that using PAI as a classification feature it is indeed possible to identify video streaming sources with high accuracy and low false-positive rates. The paper also does a thorough analysis of PAI to reveal that the feature embeds two very important classification sub-features, namely, Inter Packet Delay Variation (IPDV), and Inter Packet Generation Delay (IPGD), Classification is then performed using those two sub-features to demonstrate their abilities for video source identification.