A Research On Identifying Encrypted Videos From QUIC Streaming

The proportion of video traffic on the Internet is increasing.More and more video service providers have encrypted video for transmission.However,encrypted transmission not only protects user privacy but also brings great challenges to the supervision of the network.Dynamic adaptive streaming over HTTP(DASH)is a widely used solution for video transmission.The segmentation prescribed by it causes the traffic to show some content-related features which provides ideas for encrypted video identification.Video identification can be further carried out by extracting application data unit(ADU)from the traffic.Most of the existing encrypted video identification methods are based on accurate extraction of ADUs,but as the UDP-based QUIC protocol is applied to video transmission,the existing methods are no longer applicable.The QUIC protocol encrypts almost all content and uses a multiplexed transmission mechanism,which brings resistance to the task of identifying encrypted video.In response to the above problems,this paper no longer focuses on extracting a single ADU from QUIC traffic,but adopts an alternative plan to further realize QUIC video identification by extracting a specific combination of ADUs,which mainly includes the following research contents:(1)The construction method of the QUIC encrypted video feature sequence is proposed.Since the use of the QUIC protocol makes it impossible to obtain the ADU of the video,in order to solve this problem,the QUIC video stream is first analyzed.Through the establishment of a video plaintext segmentation dictionary combined with the burst data in the DASH video stream,its characteristics are analyzed,and different ADU combinations are defined and distinguished.Then we further extract the audio and video unit(VAU)from the specific type of ADU combination,correct its length through the method of multiple linear regression,and finally use the sequence of the corrected VAU as the video feature sequence.Experimental results show that the error rate between the corrected VAU length and the corresponding audio and video segment length in the plaintext dictionary is less than 0.5%.(2)Based on the extracted VAU feature sequence,two QUIC video identification methods are designed and implemented.According to whether it is easy to obtain the plaintext fingerprint of the video to distinguish the scenes of video identification,different video identification methods are designed for different scenes.For scenes where it is easy to construct a video plaintext fingerprint database or the amount of video is huge,an identification method based on fingerprint matching is designed,that is,the VAU sequence is used as the ciphertext fingerprint of the video,and match it with the video fingerprint in the established plaintext database using longest common subsequence(LCSS)matching method to realize video identification.For scenes where the plaintext fingerprint of the video cannot be obtained,the video classification method based on Bi LSTM-Attention is used to select the two-dimensional features of the VAU sequence,and the video is classified through the training model to achieve video identification.The experimental results show that the video identification methods based on fingerprint matching and deep learning classification proposed in this research can achieve good performance.(3)Based on the above method,the QUIC encrypted video identification prototype system is designed and implemented.The system mainly includes three modules,which are traffic preprocessing module used to generate QUIC encrypted video feature sequence,video fingerprint matching module based on LCSS and video classification module based on Bi LSTM-Attention.The system provides users with a humanized operation interface.Users can set video matching related parameters and Bi LSTM-Attention model training related parameters.The system also provides a display interface for each result.At the same time,it can store traffic processing results,video matching results,model training process,model classification results,etc.into designated files for subsequent further analysis.The system has strong practicability.