Video Streaming Forensic - Content Identification with Traffic Snooping

Previous research has shown that properties of network traffic (network fingerprints) can be exploited to extract information about the content of streaming multimedia, even when the traffic is encrypted. However, the existing attacks suffer from several limitations: (i) the attack process is time consuming, (ii) the tests are performed under nearly identical network conditions while the practical fingerprints are normally variable in terms of the end-to-end network connections, and (iii) the total possible video streams are limited to a small pre-known set while the performance against possibly larger databases remains unclear. In this paper, we overcome the above limitations by introducing a traffic analysis scheme that is both robust and efficient for variable bit rate (VBR) video streaming. To construct unique and robust video signatures with different compactness, we apply a (wavelet-based) analysis to extract the long and short range dependencies within the video traffic. Statistical significance testing is utilized to construct an efficient matching algorithm. We evaluate the performance of the identification algorithm using a large video database populated with a variety of movies and TV shows. Our experimental results show that, even under different real network conditions, our attacks can achieve high detection rates and low false alarm rates using video clips of only a few minutes.