Characterization of Traffic Analysis based video stream source identification

This paper presents the concept and characterization of Traffic Analysis (TA) for identifying sources of tunneled video streaming traffic. Such identification can be used in enterprise firewalls for blocking unauthorized viewing of tunneled video. We attempt to characterize and evaluate the impacts of the primary TA-influencing factors, namely, streaming protocol, codec, and the actual video content. A test environment is built to study the influence of those factors while Packet Size Distribution is used as the classification feature during Traffic Analysis. Analysis done on data obtained from the test environment has shown that the streaming protocols provide the most dominant source identification distinction. Also, while the codecs provide some weak distinctions, the influence of video content is marginal. In addition to in-laboratory experiments, a real-world verification for corroborating those observations is also made with commercial streaming service providers. Such long-haul experiments indicate that the end-to-end network conditions between the streaming server and video client can act as an additional influencing factor for traffic analysis towards video stream source identification. Overall, the results suggest the feasibility of TA for unknown video stream source identification with sufficiently diverse video examples.