Encrypted Video Recognition in Large-scale Fingerprint Database

被引：0
|
作者：
Wu H. [1 ,2 ,3 ]
Yu Z.-H. [1 ]
Cheng G. [1 ,2 ,3 ]
Hu X.-Y. [1 ,2 ,3 ]
机构：
[1] School of Cyber Science and Engineering, Southeast University, Nanjing
[2] Key Laboratory of Computer Network and Information Integration of Ministry of Education, Southeast University, Nanjing
[3] Key Laboratory of Computer Network Technology of Jiangsu Province, Southeast University, Nanjing
来源：
Ruan Jian Xue Bao/Journal of Software | 2021年 / 32卷 / 10期
基金：
中国国家自然科学基金;
关键词：
Application data unit (ADU); Encrypted video identification; Large-scale video fingerprint database; Transmission fingerprint; Transport layer security protocol;
D O I：
10.13328/j.cnki.jos.006025
中图分类号：
学科分类号：
摘要：
Encrypted video identification is an urgent problem in the field of network security and network management. The existing methods are to match the video transmission fingerprint of encrypted video with the video fingerprint in the video fingerprint database. The existing research mainly focuses on the study of matching recognition algorithm, but there is neither particular research on matching data sources nor the analysis of precision and false positive rate in large-scale video fingerprint library. The resulting practicality of existing methods cannot be guaranteed. In order to address this problem, this study firstly analyses the reason why the length of the cipher text of the application data unit (ADU) encrypted by TLS drifts relative to the length of the plaintext. For the first time, HTTP head feature and TLS fragment features are used as fitting features for ADU length restoration, and then this study proposes an accurate fingerprint restoration method HHTF for the encrypted ADU, and applies HHTF to the encrypted video recognition. A large fingerprint database of 200 000 videos was built based on the simulation of real Facebook videos. Theoretical derivation and calculation demonstrate that the accuracy, precision, and recall rate can reach 100%, and the false positive rate is 0 requiring only one-tenth the numbers of ADUs of the existing method. The experimental results in simulating large-scale video fingerprint database are consistent with the theoretical calculations. The application of the HHTF method makes it possible to recognize encrypted transmitted video in large-scale video fingerprint library scenarios, which is of great practicality and application value. © Copyright 2021, Institute of Software, the Chinese Academy of Sciences. All rights reserved.
引用
收藏
页码：3310 / 3330
页数：20
相关论文
共 29 条
  • [1] Zhao B, Guo H, Liu QR, Wu JX., Protocol independent identification of encrypted traffic based on weighted cumulative sum test, Ruan Jian Xue Bao/Journal of Software, 24, 6, pp. 1334-1345, (2013)
  • [2] Velan P, Cermak M, Celeda P, Drasar M., A survey of methods for encrypted traffic classification and analysis, Int'l Journal of Network Management, 25, 5, pp. 355-374, (2015)
  • [3] Xiang C, Chen Q, Xue M, Zhu H., APPCLASSIFIER: Automated app inference on encrypted traffic via Meta data analysis, Proc. of the 2018 IEEE Global Communications Conf. (GLOBECOM), pp. 1-7, (2018)
  • [4] Taylor VF, Spolaor R, Conti M, Martinovic I., Robust smartphone app identification via encrypted network traffic analysis, IEEE Trans. on Information Forensics and Security, 13, 1, pp. 63-78, (2017)
  • [5] Anderson B, Paul S, McGrew D., Deciphering Malware's use of TLS (without decryption), Journal of Computer Virology and Hacking Techniques, 14, pp. 195-211, (2018)
  • [6] Anderson B, McGrew D., Identifying encrypted Malware traffic with contextual flow data, Proc. of the 2016 ACM Workshop on Artificial Intelligence and Security, pp. 35-46, (2016)
  • [7] Ahmed ME, Ullah S, Kim H., Statistical application fingerprinting for DDoS attack mitigation, IEEE Trans. on Information Forensics and Security, 14, 6, pp. 1471-1484, (2019)
  • [8] Biernacki A., Identification of adaptive video streams based on traffic correlation, Multimedia Tools and Applications, 78, 13, pp. 18271-18291, (2019)
  • [9] Li F, Chung JW, Claypool M., Silhouette: Identifying YouTube video flows from encrypted traffic, Proc. of the 28th ACM SIGMM Workshop on Network and Operating Systems Support for Digital Audio and Video, pp. 19-24, (2018)
  • [10] Tang S, Qin XW, Wei G., Network-based video quality assessment for encrypted HTTP adaptive streaming, IEEE Access, 6, pp. 56246-56257, (2018)
123