An encrypted video recognition method for HTTP / 2 traffic multiplexing features

Abstract

The application discloses an encryption video identification method for HTTP / 2 traffic multiplexing features, and aims at encrypted videos using multiplexing HTTP / 2 protocols. The method first uses an automatic data acquisition module to acquire video plaintext data to obtain video plaintext fingerprints, and acquires video encryption transmission data in a network intermediate node, so as to construct a large video plaintext fingerprint library and an encrypted video transmission data set. Secondly, a modified fingerprint construction module is used to construct encrypted video modified fingerprints by accurately restoring the encrypted video transmission data. Finally, an encrypted video identification module is used to identify the HTTP / 2 encrypted video based on the encrypted video modified fingerprints and the large video plaintext fingerprint library through an encrypted video modified fingerprint sliding matching method. The application can identify the HTTP / 2 encrypted video distributed by the DASH technology through the video plaintext fingerprint, and has universality. In addition, the application can be applied to a constantly changing real network environment, and has good generalization performance.

Description

TECHNICAL FIELD

[0001] The application relates to an encrypted video identification method for HTTP / 2 traffic multiplexing features, and belongs to the technical field of computer network security. BACKGROUND

[0002] In recent years, with the development of mobile Internet, video applications have become the mainstream application in the Internet. YouTube, Facebook, Tik Tok, Instagram and Douyin, etc. Domestic and foreign video sharing platforms provide users with convenient video sharing and forwarding functions, and the videos spread in the Internet have deeply penetrated into the social life of netizens.

[0003] Due to the diversity of video sources in video platforms and social platforms, if the platform audit is not timely, the videos provided by various platforms will also contain some harmful videos, which we call public hazard videos. These public hazard videos have caused serious adverse effects on the network space and society. However, due to the characteristics of large quantity, low production cost, fast transmission speed and encrypted transmission, these videos have caused great difficulties for supervision. The national network supervision department urgently needs to accurately identify the public hazard videos that are encrypted and spread in the network.

[0004] At present, the global mainstream video platforms have all adopted encryption technology to transmit video data. According to the report released by W3Techs website, the proportion of websites that use encryption protocols such as HTTPS by default in the global websites has risen from 77.4% in January 2022 to 81.5% in January 2023. With the increasing proportion of encrypted traffic in the Internet, especially the rapid increase of encrypted video traffic proportion, the encryption transmission technology brings safety protection to ordinary users, but at the same time, it also leads to the doubling of the difficulty of network supervision for network supervision agencies to monitor the network environment.

[0005] According to the data source, there are two main methods for identifying public harm videos. One method is to analyze the video files of the video platform, learn the images in the video through deep learning, and identify the content of the unknown video based on the trained model. Then the identified public harm videos are blocked. The data source of this method is the video file of the video sharing platform, which is suitable for the managers of the video platform to conduct content review. However, this method requires expensive hardware resources, and many small platforms are unable to implement due to cost and technical limitations. Some video platforms are also unwilling to conduct content review subjectively, leading to the proliferation of network public harm videos. The second method is to analyze the traffic data collected at the main network access points, extract the features of encrypted video traffic, and identify the transmitted public harm videos based on the existing public harm video library through traffic feature matching. This method does not require cooperation with the platform and has good controllability when deployed by regulatory authorities. The difficulty lies in the fact that due to the continuous evolution of network encryption transmission protocols, existing methods cannot analyze data transmitted using new protocols. Protocols using multiplexing technology such as HTTP / 2 have been widely deployed and have greatly changed the transmission characteristics of encrypted traffic, so the second method needs to analyze the new traffic features generated by multiplexing technology.

[0006] However, there are still some general problems in existing encrypted video content identification research. First, due to the huge workload and time-consuming nature of collecting large encrypted video datasets, current research mostly uses small and micro datasets for research and verification. A few studies are conducted for large datasets, but use simulated large fingerprint libraries, which leads to a lack of verification for large real datasets in existing research. Second, current identification of encrypted video content is mainly based on HTTP / 1.1 protocol. In recent years, with the rapid popularization of multiplexing protocols such as HTTP / 2, QUIC, and HTTP / 3, the transmission characteristics of encrypted video traffic have changed greatly, and traditional identification methods based on HTTP / 1.1 protocol cannot be applied to scenarios using new multiplexing protocols.

[0007] HTTP / 2 protocol introduces new functions such as header compression, server push and multiplexing to improve transmission efficiency, but the header compression and multiplexing functions make the previous video modification fingerprint construction method for HTTP / 1.1 unable to be used for HTTP / 2 video traffic. In HTTP / 1.1, the length of the header data is usually distributed in a certain range, while in HTTP / 2, due to the use of header compression technology, the length distribution of the header data has changed a lot, so the way of filtering the header data in the traffic analysis method will also change; in addition to header compression, multiplexing is also a major factor affecting video recognition, which directly leads to the existing video stream analysis method for HTTP / 1.1 being unable to be applied to HTTP / 2 video traffic. In HTTP / 1.1, audio and video data often transmit different types of data through two TCP streams to improve efficiency. In HTTP / 2, due to the introduction of multiplexing function, only one TCP stream is often needed to carry multiple data interaction transmission. Since audio and video data are transmitted alternately on the same TCP stream, the response data between two requests often contains mixed audio and video data, and since the traffic is encrypted, it brings great difficulty to the modification and restoration of data length.

[0008] In the existing invention patent "A method for identifying YouTube DASH video transmitted by TLS protocol encryption", it mainly aims at the identification of encrypted video using HTTP / 1.1 protocol, and the modification and restoration operation of encrypted video data is mainly based on the transmission characteristics of HTTP / 1.1 protocol, which is difficult to be applied to the identification of encrypted video using multiplexing HTTP / 2 protocol. In addition, compared with the existing invention patent "A method for identifying YouTube DASH video transmitted by QUIC protocol encryption", although both HTTP / 2 protocol and QUIC protocol are multiplexing protocols, the main difference is that HTTP / 2 is a TCP-based transmission protocol, while QUIC is a UDP-based protocol, and the transmission of audio and video data is completely different, resulting in completely different traffic characteristics of video in the network link. The division method and modification and restoration method of encrypted audio and video data units proposed in the method for identifying DASH video transmitted by QUIC protocol encryption are not applicable to DASH video transmitted by HTTP / 2 protocol encryption. In summary, the encrypted video identification method proposed in the present application has certain innovativeness and is applicable to the identification of video transmitted by HTTP / 2 protocol encryption. SUMMARY

[0009] To solve the above problems, the application discloses an encryption video identification method for HTTP / 2 traffic multiplexing features, which first collects video plaintext fingerprints by using an automatic program for a video platform, and constructs a large video plaintext fingerprint database, secondly, collects HTTP / 2 video encryption transmission data in a network link intermediate node, and sequentially corrects and restores the video encryption transmission data interference of the TLS protocol and the HTTP / 2 protocol, thereby constructing an encryption video correction fingerprint, and finally, based on the encryption video correction fingerprint and the video plaintext fingerprint database, the fingerprint dynamic sliding window matching method is used for matching and identifying the encryption video correction fingerprint, and the score is calculated, and finally the video plaintext fingerprint with the highest score and the video description information thereof are taken as the encryption video identification result. The application has good universality, and can be used for identifying the encryption video content of the DASH video platform of the HTTP / 2 protocol transmission video data in the network intermediate node.

[0010] In order to achieve the purpose of the application, the technical steps of the scheme are as follows: an encryption video identification method for HTTP / 2 traffic multiplexing features, the method comprising the following steps:

[0011] Step (1) uses video plaintext fingerprint automatic collection technology to automatically collect video plaintext information, obtain video plaintext fingerprints, and construct a large video plaintext fingerprint database;

[0012] Step (2) uses encryption video transmission data automatic collection technology to automatically collect and save the encryption transmission data during video playing;

[0013] Step (3) pre-processes the video encryption transmission data collected in step (2), and extracts audio and video combination data units CDU from the data stream thereof;

[0014] Step (4) corrects the TLS protocol interference for the audio and video combination data units CDU extracted in step (3);

[0015] Step (5) corrects the HTTP / 2 protocol interference for the correction result of step (4), and constructs an encryption video correction fingerprint;

[0016] Step (6) takes the encryption video correction fingerprint and the large video plaintext fingerprint database as the basis, performs sliding matching on the encryption video correction fingerprint, and saves the matching result;

[0017] Step (7) calculates the score of each video plaintext fingerprint matched by using the matching result of step (6), and takes the video plaintext fingerprint with the highest score and the video description information thereof as the result of encryption video identification.

[0018] Further, in step (1), the video plaintext fingerprint refers to the video plaintext data segment length sequence, and the plaintext fingerprint information of the video comes from the description file of the video. In a playback scenario using the DASH streaming protocol, the video is encoded in advance by the VBR algorithm into multiple quality versions of different bit rates and stored on the server side, and each encoded video is cut into video segments of equal length. These video segment information is saved in the video description (MPD) file. Since the picture content of each video segment is different, the segment size also presents certain differences. This difference in video segment size sequence can be used as a video plaintext fingerprint to identify encrypted videos. Step (1) specifically includes the following sub-steps:

[0019] (1.1) Write an automatic collection program to obtain a video list by keyword search and collect video URLs;

[0020] (1.2) According to the video URL, add the corresponding signature information, construct the URL of the video description file, and download and parse the video description file through the URL;

[0021] (1.3) According to the video index segment resource address and byte range parsed from the video description file, download the video index segment;

[0022] (1.4) Unpack the video index segment, extract the video segment size information, construct the video plaintext fingerprint, and store the video plaintext fingerprint and other video description information as a video plaintext fingerprint instance in the video plaintext fingerprint database.

[0023] Further, step (2) specifically includes the following sub-steps:

[0024] (2.1) Use the robot process automation (RPA) technology platform UiBot as the control center of the automatic collection system, simulate manual operation, and write a corresponding customized process automation program according to the video traffic data collection process;

[0025] (2.2) Simulate manual operation through UiBot to control the computer to automatically open the traffic data collection tool and collect the traffic data set;

[0026] (2.3) Simulate manual operation through UiBot to control the computer to open the browser and enter the video page with the video URL as input, and automatically click to play the video;

[0027] (2.4) Wait for the video to finish playing, stop the collection through UiBot, format the collected data, and store it;

[0028] (2.5) judging whether the video URL list is empty, if empty, stopping the collection, otherwise entering step (2.2) to perform the data collection work of the next video.

[0029] Further, in the step (3), the audio and video combined data unit CDU refers to the combined data of the audio segment and the video segment. In the latest DASH streaming protocol video content distribution mechanism, when actually playing a video, the client will continuously request multiple video and audio segments, and the combination mode includes multiple video segments, multiple audio segments, and the combination of multiple audio and video segments. These requests will obtain continuously transmitted response data. For the convenience of subsequent introduction, these continuously transmitted combined response data are collectively referred to as combined data units CDU. Due to the use of multiplexing technology, the audio and video packets in these CDUs are mixed and transmitted after encryption, and cannot be distinguished. Therefore, the CDU is taken as a whole to correct and restore the length. The step (3) specifically includes the following sub-steps:

[0030] (3.1) extracting the audio and video data stream, first screening out the encrypted TCP data stream using the 443 port through the 443 port of the TCP, and second extracting the audio and video data stream according to the data size of the encrypted TCP data stream and the server SNI information contained in the handshake information "Client Hello" in the TLS connection;

[0031] (3.2) combining and restoring the TLS fragment sequence of the data stream from the TCP packet sequence of the audio and video data stream. Since TCP is a non-encrypted protocol, the length information of the encrypted data block recorded in the "PlainTextHeader" field of the TLS fragment in the TCP fragment header information and the payload data can be used to combine and restore the TLS fragment sequence of the audio and video data stream;

[0032] (3.3) accurately dividing the encrypted audio and video combined data unit CDU. Due to the multiplexing feature of HTTP / 2, multiple transmission data of data streams will exist on the same TCP connection at the same time. When the video server responds to each group of audio and video CDU data, it will first send several WINDOW_UPDATE frames to update the data window size of each HTHP / 2 stream, and these WINDOW_UPDATE frames are encapsulated in the same TLS block for transmission. Therefore, the CDU can be divided by these special TLS blocks containing the WINDOW_UPDATE frame with fixed length.

[0033] Further, in the step (4), the TLS protocol interference refers to the influence of the TLS protocol on the length of the audio / video data unit CDU during data transmission. When the audio / video data unit CDU enters the network link for transmission, it will be processed by the TLS protocol, and corresponding operations such as splitting, compression, encryption and padding will be performed, and corresponding protocol headers and control information will be added to ensure stable and reliable transmission of the encrypted CDU. However, the above operations of the TLS protocol will change the CDU data length, so in order to achieve the purpose of encrypted data correction and restoration, the length of all additional control information needs to be subtracted from the actual transmission load length. In addition, due to the data compression, padding and encryption mechanisms of the TLS protocol, and the addition of TLS headers and other additional information, it is impossible to restore the payload data without knowing the encryption suite and secret key, and only the linear regression method can be used to evaluate the interference introduced by the TLS protocol before and after the payload data. The step (4) specifically includes the following sub-steps:

[0034] (4.1) Select a CDU that only uses one TLS segment to carry audio / video data, and the corresponding plaintext data of the CDU, at this time:

[0035]

[0036] wherein, represents the corrected and restored CDU data length, TLS_Seg len represents the TLS segment length, TLS_θ len The mean value of the interference introduced by a single TLS data segment after carrying the transmission data, that is, the length interference value of a single TLS data segment on the carried transmission data, H2_Frame_Header len represents the length of the header of an HTTP / 2 DATA frame, which is fixed at 9 bytes according to RFC 7540;

[0037] (4.2) Obtain TLS_Seg len parameters and parameters in the formula of (4.1);

[0038] (4.3) Substitute the parameters obtained in (4.2) into the formula in (4.1) to train a linear regression model and obtain the value of the parameter TLS_θ len , that is, the length interference value of a single TLS data segment on the carried transmission data;

[0039] (4.4) Subtract the TLS interference value TLS_θ len from each TLS segment corresponding to each CDU extracted in step (3).

[0040] Further, in the step (5), the HTTP / 2 protocol interference refers to the influence of the HTTP / 2 protocol on the length of the audio and video data unit CDU when the audio and video data is transmitted. When the audio and video data is transmitted by using the HTTP / 2 protocol, the HTTP / 2 protocol encapsulates the HTTP load data into a plurality of DATA frames, and the actual transmission data length of the audio and video data CDU is slightly larger than the original data length when the audio and video data CDU is transmitted by using the HTTP / 2 protocol. In order to overcome the interference of the HTTP / 2 protocol on the length of the audio and video data, that is, to remove the additional information added by the HTTP / 2 protocol, the number of DATA frames carrying the audio and video data CDU needs to be calculated. The present application uses a random forest model in machine learning to calculate the number of DATA frames carrying the audio and video data CDU. The step (5) specifically comprises the following sub-steps:

[0041] (5.1) Take out part of the CDU and the corresponding TLS segment sequence after removing the TLS protocol interference, and obtain the plaintext data corresponding to the CDU. The number of HTTP / 2 DATA frames corresponding to the CDU is calculated according to the following formula:

[0042]

[0043] Wherein, N H2 represents the number of HTTP / 2 DATA frames carrying the CDU data, Total_TLS_Seg len * represents the sum of all TLS segment data after removing the TLS protocol interference corresponding to the CDU, represents the length of the plaintext data corresponding to the encrypted audio and video data unit CDU;

[0044] (5.2) Take the number N H2 of HTTP / 2 DATA frames corresponding to the CDU as a label, and take the TLS segment sequence after removing the TLS protocol interference as a feature to train the random forest model;

[0045] (5.3) Use the trained random forest model to calculate the number of HTTP / 2 DATA frames contained in the TLS segment sequence of each CDU;

[0046] (5.4) Remove the length occupied by the header of the HTTP / 2 DATA frame from the data obtained in step (4) after removing the TLS protocol interference, and the length of the plaintext data of the restored audio and video combination data unit CDU can be obtained, that is:

[0047]

[0048] Wherein, represents the corrected length of the restored CDU, that is, the plaintext length of the CDU, Total_TLS_Seglen * N represents the sum of all TLS fragment data after interference of the TLS protocol is eliminated, and N H2 N represents the number of HTTP / 2 DATA frames carrying the CDU data.

[0049] (5.5) The sequence of the corrected CDU size is taken as the encrypted video correction fingerprint.

[0050] Further, in the step (6), the encrypted video correction fingerprint sliding matching refers to putting the encrypted video correction fingerprint restored in the step (5) into the video plaintext fingerprint database for matching and identification. Since the CDU contains multiple continuous audio or video segments, that is, one correction fingerprint fragment can correspond to multiple continuous fragments of the video plaintext fingerprint, therefore, the application adopts a way of dynamically adjusting the size of the sliding window to realize one-to-many matching, and records the matching results of each correction fingerprint fragment in the video plaintext fingerprint database. The step (6) specifically comprises the following sub-steps:

[0051] (6.1) A video plaintext fingerprint is taken out from the video plaintext fingerprint database;

[0052] (6.2) Initialization, two sliding windows are set: a correction fingerprint window and a plaintext fingerprint window, wherein the correction fingerprint window slides on the encrypted video correction fingerprint in sequence, and the window size is always 1; the plaintext fingerprint window slides on the taken-out video plaintext fingerprint, and the window size dynamically changes from 1 to x, and the matching error range is set as [-T T];

[0053] (6.3) The sum of the data lengths in the two windows is compared, if the sum of the data amounts in the plaintext fingerprint window and the data size in the correction fingerprint window are within the error range [-T T], it is considered that they are matched, and the plaintext fingerprint sequence in the plaintext fingerprint window at this time and the corresponding video ID are recorded, otherwise, it is considered that they are not matched, the plaintext fingerprint window continues to slide forward, and after sliding to the tail of the video plaintext fingerprint, the plaintext fingerprint window size is increased by one, and then the sliding starts from the head again until the plaintext fingerprint window size reaches the upper limit x;

[0054] (6.4) The correction fingerprint window is moved backward by one position, and the step (6.3) operation is repeated to match the next correction fingerprint fragment;

[0055] (6.5) After the matching of each fragment of the correction fingerprint and the taken-out video plaintext fingerprint is completed, a new video plaintext fingerprint is taken out from the video plaintext fingerprint database again to enter the step (6.2) for matching, and the matching work is ended after the plaintext fingerprints in the video plaintext fingerprint database are traversed.

[0056] Further, the step (7) specifically comprises the following sub-steps:

[0057] (7.1) Statistics of the matching results of the modified fingerprints in step (6), and calculates the scores of each plaintext fingerprint with matching results;

[0058] (7.2) Take out the video plaintext fingerprint with the highest score and its related video description information from the video plaintext fingerprint database as the encrypted video identification result.

[0059] Compared with the prior art, the technical scheme of the present application has the following beneficial technical effects:

[0060] (1) In the existing research method of using side channel type video fingerprint to identify encrypted video, due to the difficulty and cost of manually constructing a large video dataset, small and micro datasets are often used for research and verification, which leads to the lack of verification for large real datasets in existing research. The present application uses automatic collection technology to automatically collect video plaintext data to obtain video plaintext fingerprints, and automatically collects video encrypted transmission data in the network intermediate node, thereby constructing a large video dataset containing encrypted video transmission data and a video plaintext fingerprint library, filling the gap of no public large video dataset in the field of encrypted video identification;

[0061] (2) The encrypted video identification method proposed in the present application is based on the HTTP / 2 flow multiplexing feature, which can overcome the problem that the traditional identification method based on HTTP / 1.1 protocol cannot be applied to the scene using the new multiplexing protocol. According to the characteristics of video data transmission using the new multiplexing protocol HTTP / 2, the encrypted video modification fingerprint is constructed by the targeted encrypted data modification restoration method, and the encrypted video modification fingerprint and the video plaintext fingerprint library database are used to accurately identify the encrypted video content;

[0062] (3) The encrypted video identification method proposed in the present application has low identification cost. For video platforms, a large video plaintext fingerprint library is constructed by using automatic collection technology at one time. For the to-be-identified video in the video platform, only a small amount of video encrypted transmission data needs to be collected at the network intermediate node to accurately identify the encrypted video;

[0063] (4) The encrypted video identification method proposed in the present application has strong generalization performance and is applicable to all DASH video platforms using the multiplexing protocol HTTP / 2 transmission. It can overcome the adverse effects of network environment changes on encrypted video identification and accurately identify encrypted video in different network environments;

[0064] (5) The encryption video identification method for the HTTP / 2 traffic multiplexing feature can identify encrypted videos in a network intermediate node, and can be used for a network supervision department to monitor and identify public hazard videos in a network intermediate node, thereby providing strong technical support for preventing the rapid spread of public hazard videos. BRIEF DESCRIPTION OF DRAWINGS

[0065] Figure 1 The overall framework diagram of the encryption video identification method for the HTTP / 2 traffic multiplexing feature is shown in the figure.

[0066] Figure 2 The flowchart of the encryption video identification method for the HTTP / 2 traffic multiplexing feature is shown in the figure.

[0067] Figure 3 The flowchart of the automatic construction of a large video plaintext fingerprint database is shown in the figure.

[0068] Figure 4 The principle diagram of the encrypted video correction fingerprint sliding matching is shown in the figure. DETAILED DESCRIPTION

[0069] The technical solutions provided by the present application will be described in detail below with reference to specific embodiments, and it should be understood that the following specific embodiments are only used to illustrate the present application and are not used to limit the scope of the present application.

[0070] Embodiment: The encryption video identification method for the HTTP / 2 traffic multiplexing feature provided by the present application has the overall system architecture as shown in the figure, and a typical video platform Instagram is specifically and in detail introduced, which specifically includes the following steps: Figure 1

[0071] Step (1) uses a video plaintext fingerprint automatic collection technology to automatically collect video plaintext information, obtain video plaintext fingerprints, and construct a large video plaintext fingerprint database.

[0072] In an embodiment of the present application, step (1) specifically includes the following sub-steps:

[0073] (1.1) An automatic collection program is written, a video list is obtained through keyword search, and a video URL is collected;

[0074] (1.2) According to the video URL, the corresponding signature information is added, the URL of the video description file is constructed, the video description file is downloaded and parsed through the URL, and the video description file is parsed.

[0075] ​(1.3) According to the resource address and byte range of the video index segment parsed from the video description file (Index Range), the video index segment is downloaded. For example, for the video URL: https: / / www.instagram.com / p / Cg66y2LAzNG / , the resource address and byte range of the video index segment parsed from the downloaded video description file are shown in Table 1:

[0076] Table 1 Resource address and byte range of video index segment corresponding to video Cg66y2LAzNG

[0077]

[0078] (1.4) The video index segment is decapsulated, the video segment size information is extracted, the video plaintext fingerprint is constructed, and the video plaintext fingerprint and other video description information are stored together as a video plaintext fingerprint instance in the video plaintext fingerprint database. For example, the plaintext fingerprint instance of video Cg66y2LAzNG is shown in Table 2:

[0079] Table 2 Video plaintext fingerprint of video Cg66y2LAzNG

[0080] Vid Message Seg 1 2 3 4 ... Cg66y2LAzNG v_mp4_90s_720x1280(720w)_8397889 20 121693 159335 422180 397920 ... Cg66y2LAzNG v_mp4_90s_240x426(240w)_1344217 20 25752 35872 80386 76182 ... Cg66y2LAzNG v_mp4_90s_314x558(314w)_2330355 20 31351 46188 120974 109853 ... Cg66y2LAzNG a_mp4_90s_44100(91936bw)_1033156 46 24180 24650 24489 24493 ...

[0081] Step (2) uses an encrypted video transmission data automatic collection technology to automatically collect and save encrypted transmission data during video playback.

[0082] In an embodiment of the present application, step (2) specifically includes the following sub-steps:

[0083] (2.1) Use the robot process automation (RPA) technology platform UiBot as the control center of the automatic collection system, simulate manual operation, and write a corresponding customized process automation program according to the video traffic data collection process;

[0084] (2.2) Simulate manual operation through UiBot, control the computer to automatically open the traffic data collection tool, and collect the traffic data set;

[0085] (2.3) Simulate manual operation through UiBot, use the video URL as input, control the computer to open the browser, enter the video page, and automatically click to play the video;

[0086] (2.4) Wait until the video is played, control the traffic collection tool to stop collecting through UiBot, format the naming, and store the collected data;

[0087] (2.5) judging whether the video URL list is empty, if empty, stopping the collection, otherwise entering step (2.2) to perform the data collection work of the next video.

[0088] Step (3) pre-processes the encrypted transmission data of the video collected in step (2) to extract the audio-video combined data unit CDU from the data stream thereof.

[0089] In an embodiment of the present application, step (3) specifically comprises the following sub-steps:

[0090] (3.1) extracting the audio-video data stream, first filtering out the encrypted TCP data stream using the 443 port through the 443 port of TCP, and second extracting the audio-video data stream according to the data size of the encrypted TCP data stream and the server SNI information contained in the handshake information "Client Hello" in the TLS connection. In the present example, the general form of the server SNI is scontent-laxx-x.cdninstagram.com;

[0091] (3.2) combining and restoring the TLS fragment sequence of the data stream from the TCP packet sequence of the audio-video data stream. Since TCP is a non-encrypted protocol, the length information of the encrypted data block recorded in the "PlainText Header" field of the TLS fragment in the TCP load data and the header information of the TCP fragment can be used to combine and restore the TLS fragment sequence of the audio-video data stream;

[0092] (3.3) accurately dividing the encrypted audio-video combined data unit CDU. Due to the multiplexing feature of HTTP / 2, there will be multiple transmission data of data streams on the same TCP connection at the same time. The video server will first send several WINDOW_UPDATE frames to update the data window size of each HTPP / 2 stream when responding to each group of audio-video CDU data, and these WINDOW_UPDATE frames are encapsulated in the same TLS block for transmission. Therefore, the CDU can be divided by these special TLS blocks with fixed length. For example, the TLS fragment sequence of the divided part of the CDU is shown in Table 3:

[0093] Table 3 TLS fragment sequence of part of the encrypted audio-video combined data unit CDU

[0094]

[0095]

[0096] Step (4) corrects the interference of the TLS protocol for the audio-video combined data unit CDU extracted in step (3).

[0097] In an embodiment of the present application, step (4) specifically comprises the following sub-steps:

[0098] (4.1) Select a CDU that uses only one TLS segment to carry audio and video data, and the corresponding plaintext data of the CDU, at this time:

[0099]

[0100] Wherein, represents the length of the corrected and restored CDU data, TLS_Seg len represents the length of the TLS segment, TLS_θ len refers to the mean value of the interference introduced by a single TLS data segment after carrying the transmission data, that is, the length interference value of a single TLS data segment on the carried transmission data, H2_Frame_Header len represents the length of the header of an HTTP / 2 DATA frame, which is fixed at 9 bytes according to RFC 7540;

[0101] (4.2) Obtain TLS_Seg len in the formula in (4.1) Parameter and

[0102] (4.3) Substitute the parameters obtained in (4.2) into the formula in (4.1) to train a linear regression model and obtain the value of parameter TLS_θ len , that is, the length interference value of a single TLS data segment on the carried transmission data. In this example, the linear regression model is trained by 33,020 groups of CDU data containing only one TLS block, and the result is TLS_θ len = 22, that is, in this example, the interference introduced by each TLS segment after carrying the transmission data is 22 bytes;

[0103] (4.4) Subtract the TLS interference value TLS_θ len from each TLS segment corresponding to each CDU extracted in step (3), for example, the result of removing the TLS interference from the CDU in Table 3 is shown in Table 4:

[0104] Table 4 shows the result of removing the TLS interference from the CDU in Table 3

[0105] CDU_id CDU_size TLS_n 1 2 3 4 5 6 7 8 ... 1 55025 53 1 853 104 55 1500 4096 947 90 ... 2 145990 52 1 1500 4096 4096 4096 2604 1500 4096 ... 3 144514 59 1 4096 4096 1500 4096 2604 1500 4096 ... 4 944433 366 1 4096 4096 78 1370 1500 2573 4064 ... 5 185629 77 1 4096 4096 3554 4096 1500 4096 4096 ...

[0106] Step (5) further corrects the correction result of step (4) for HTTP / 2 protocol interference, and constructs an encrypted video correction fingerprint.

[0107] In an embodiment of the present application, step (5) specifically comprises the following sub-steps:

[0108] (5.1) Take out the CDU and its corresponding TLS segment sequence removing the interference of TLS protocol, and obtain the plaintext data corresponding to the CDU, and calculate the number of HTTP / 2 DATA frames corresponding to the CDU according to the following formula:

[0109]

[0110] Wherein, N H2 represents the number of HTTP / 2 DATA frames carrying CDU data, Total_TLS_Seg len * represents the sum of all TLS segment data after removing the interference of TLS protocol corresponding to the CDU, represents the length of the plaintext data corresponding to the encrypted audio and video data unit CDU;

[0111] (5.2) Take the number of HTTP / 2 DATA frames N H2 as a label, and the TLS segment sequence removing the interference of TLS protocol as a feature, train a random forest model;

[0112] (5.3) Use the trained random forest model to calculate the number of HTTP / 2 DATA frames contained in the TLS segment sequence of each CDU. In this example, the trained random forest model is used to calculate the number of HTTP / 2 DATA frames N H2 The results of parameter prediction are shown in Table 5:

[0113] Table 5: Calculate the number of HTTP / 2 DATA frames N H2 The results of parameter calculation

[0114] CDU_id CDU_size TLS_n <![CDATA[N H2 ]]> 1 2 3 4 5 6 7 ... 1 55025 53 22 1 853 104 55 1500 4096 947 ... 2 145990 52 12 1 1500 4096 4096 4096 2604 1500 ... 3 144514 59 14 1 4096 4096 1500 4096 2604 1500 ... 4 944433 366 89 1 4096 4096 78 1370 1500 2573 ... 5 185629 77 20 1 4096 4096 3554 4096 1500 4096 ...

[0115] (5.4) Remove the length occupied by the header of HTTP / 2 DATA frame from the data obtained in step (4) removing the interference of TLS protocol, and the length of the plaintext data of the restored audio and video combination data unit CDU can be obtained, that is:

[0116]

[0117] Wherein, represents the corrected length of the restored CDU, that is, the plaintext length of the CDU, Total_TLS_Seg len * represents the sum of all TLS segment data after removing the interference of TLS protocol corresponding to the CDU, N H2The number of HTTP / 2 DATA frames representing the CDU data. The restoration result of removing the HTTP / 2 interference from the CDU in Table 5 is shown in Table 6:

[0118] Table 6 restoration result of removing the HTTP / 2 interference from the CDU in Table 5

[0119]

[0120] (5.5) The sequence of the corrected CDU size is taken as the encrypted video correction fingerprint.

[0121] Step (6) is based on the encrypted video correction fingerprint and the large video plaintext fingerprint library, and the encrypted video correction fingerprint is matched by sliding, and the matching result is saved.

[0122] In an embodiment of the present application, step (6) specifically comprises the following sub-steps:

[0123] (6.1) A video plaintext fingerprint is taken out from the video plaintext fingerprint database;

[0124] (6.2) Initialization, set two sliding windows: correction fingerprint window and plaintext fingerprint window, wherein the correction fingerprint window slides on the encrypted video correction fingerprint in sequence, and the window size is always 1, the plaintext fingerprint window slides on the taken-out video plaintext fingerprint, and the window size dynamically changes from 1 to x, and the matching error range is set to [-T T]; in this example, the upper limit of the plaintext fingerprint window size is set to x = 7, and the matching error range is set to [-28 28];

[0125] (6.3) Compare the sum of the data lengths in the two windows, if the sum of the data amounts in the plaintext fingerprint window and the data size in the correction fingerprint window are within the error range [-T T], it is considered to be matched, and the plaintext fingerprint sequence in the plaintext fingerprint window at this time and its corresponding video ID are recorded, otherwise, it is considered to be not matched, and the plaintext fingerprint window continues to slide forward, and after sliding to the tail of the video plaintext fingerprint, the plaintext fingerprint window size is increased by one, and then the sliding starts from the beginning again, until the plaintext fingerprint window size reaches the upper limit x;

[0126] (6.4) The correction fingerprint window moves one position backward, and the step (6.3) operation is repeated to match the next correction fingerprint fragment;

[0127] (6.5) After the matching of each fragment of the correction fingerprint and the taken-out video plaintext fingerprint is completed, a new video plaintext fingerprint is taken out from the video plaintext fingerprint database again to enter step (6.2) for matching, until the plaintext fingerprints in the video plaintext fingerprint database are traversed and the matching work is completed. In this example, the principle of the encrypted video correction fingerprint sliding matching is as follows:Figure 4 as shown.

[0128] Step (7) calculates the scores of the matched video plaintext fingerprints using the matching results of step (6), and takes the video plaintext fingerprint with the highest score and its video description information as the result of the encrypted video identification.

[0129] In an embodiment of the present application, step (7) specifically comprises the following sub-steps:

[0130] (7.1) Statistics the matching results of the modified fingerprints in step (6), and calculates the scores of the plaintext fingerprints with matching results;

[0131] (7.2) Takes the video plaintext fingerprint with the highest score and its related video description information from the video plaintext fingerprint database as the result of the encrypted video identification.

[0132] The technical means disclosed by the present application is not limited to the technical means disclosed by the above-mentioned embodiments, but also includes the technical solutions composed of any combination of the above technical features. It should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can also be considered as the protection scope of the present application.

Claims

1. A method for encrypted video recognition oriented to HTTP / 2 traffic multiplexing features, characterized in that, The method comprises the following steps: Step (1) automatically collecting video plaintext information by using a video plaintext fingerprint automatic collection technology, obtaining a video plaintext fingerprint, and constructing a large video plaintext fingerprint database; Step (2) automatically collecting encrypted transmission data during video playing and saving by using an encrypted video transmission data automatic collection technology; Step (3) performing a preprocessing operation on the video encrypted transmission data collected in step (2) to extract audio-video combined data units CDU (Chunk Data Unit) from the data stream thereof; Step (4) correcting the audio-video combined data units CDU extracted in step (3) for TLS protocol interference; Step (5) correcting the correction result of step (4) for HTTP / 2 protocol interference, and constructing an encrypted video correction fingerprint; Step (6) performing encrypted video correction fingerprint sliding matching based on the encrypted video correction fingerprint and the large video plaintext fingerprint database, and saving the matching result; Step (7) counting the matching result of step (6), calculating the score of each video plaintext fingerprint matched, and taking the video plaintext fingerprint with the highest score and its video description information as the result of encrypted video identification; The step (3) comprises the following sub-steps: (3.1) extracting the audio-video data stream, first screening out the encrypted TCP data stream using the 443 port of TCP, and then extracting the audio-video data stream according to the data size of the encrypted TCP data stream and the server SNI information contained in the handshake information "Client Hello" in the TLS connection; (3.2) combining and restoring the TLS fragment sequence of the data stream from the TCP packet sequence of the audio-video data stream, since TCP is a non-encrypted protocol, the TLS fragment sequence of the audio-video data stream is combined and restored by the TCP fragment header information and the length information of the encrypted data block recorded in the "PlainText Header" field of the TLS fragment in the payload data; (3.3) accurately dividing the encrypted audio-video combined data unit CDU, since the HTTP / 2 has the multiplexing feature, there are multiple transmission data of data streams on the same TCP connection, and the video server responds to each group of audio-video CDU data by first sending several WINDOW_UPDATE frames to update the data window size of each HTPP / 2 stream, and these WINDOW_UPDATE frames are encapsulated in the same TLS block for transmission, so the CDU is divided by these special TLS blocks containing the WINDOW_UPDATE frames with fixed length; The step (4) comprises the following sub-steps: (4.1) selecting a CDU using only one TLS fragment to carry audio-video data, and the plaintext data corresponding to the CDU, at this time: wherein, represents the length of the corrected reduced CDU data, represents the length of the TLS fragment, the mean value of the amount of interference introduced by a single TLS data segment after carrying the transmission data, i.e. the length interference value of a single TLS data segment on the carried transmission data, represents the length of the header of a HTTP / 2 DATA frame, which is fixed as 9 bytes according to RFC7540; (4.2) obtaining the parameters in the formula of (4.1) and parameters; (4.3) substituting the parameters obtained in (4.2) into the formula in (4.1) to train a linear regression model to obtain parameters , that is, the length interference value of a single TLS data segment on the transmission data carried thereby; (4.4) subtracting the TLS interference value from each TLS slice corresponding to each CDU extracted in step (3) .

2. The method of claim 1, wherein the method is a method of encrypted video recognition oriented to HTTP / 2 traffic multiplexing features. The step (1) comprises the following sub-steps: (1.1) writing an automatic collection program to obtain a video list by keyword search and collect a video URL; (1.2) According to the video URL, add the corresponding signature information, construct the URL of the video description file, download and parse the video description file through the URL; (1.3) According to the video index segment resource address and byte range (IndexRange) parsed from the video description file, download the video index segment; (1.4) Unpack the video index segment, extract the video segment size information, construct the video plaintext fingerprint, and store the video plaintext fingerprint and other video description information in the video plaintext fingerprint database as a video plaintext fingerprint instance.

3. The encrypted video identification method according to the HTTP / 2 traffic multiplexing feature according to claim 2, characterized in that, the step (2) comprises the following sub-steps: (2.1) Taking the robot process automation (RPA) technology platform UiBot as the control center of the automatic acquisition system, simulating manual operation, and writing a corresponding customized process automation program according to the video traffic data acquisition process; (2.2) Simulating manual operation through UiBot, controlling the computer to automatically open the traffic data acquisition tool, and collecting the traffic data set; (2.3) Simulating manual operation through UiBot, taking the video URL as input, controlling the computer to open the browser, entering the video page, and automatically clicking to play the video; (2.4) Waiting for the video to be played, stopping the acquisition through UiBot, and storing the collected data after formatting the naming; (2.5) Determine whether the video URL list is empty, if not, stop the acquisition, otherwise, go to step (2.2) to collect the data of the next video.

4. The encrypted video identification method according to the HTTP / 2 traffic multiplexing feature according to claim 3, characterized in that, the step (5) comprises the following sub-steps: (5.1) Take out part of the CDU and its corresponding TLS fragment sequence without TLS protocol interference, and obtain the plaintext data corresponding to the CDU, calculate the number of HTTP / 2 DATA frames corresponding to the CDU according to the following formula, wherein, represents the number of HTTP / 2 DATA frames carrying the CDU data, represents the sum of all TLS fragment data after removing the interference of the TLS protocol by the CDU, represents the length of the plaintext data corresponding to the encrypted audio and video data unit CDU; (5.2) the number of HTTP / 2 DATA frames corresponding to the CDU As a label, the TLS fragment sequence without the interference of the TLS protocol is taken as a feature, and a random forest model is trained. (5.3) Calculate the number of HTTP / 2 DATA frames contained in the TLS fragment sequence of each CDU using the trained random forest model; (5.4) Remove the length occupied by the header of the HTTP / 2 DATA frame from the data obtained in step (4) without TLS protocol interference, and the length of the plaintext data of the restored audio-video combination data unit CDU is obtained, that is: wherein, represents the length of the modified reduced CDU, i.e., the plaintext length of the CDU, represents the sum of all TLS fragment data corresponding to the CDU after interference of the TLS protocol is eliminated, represents the number of HTTP / 2 DATA frames carrying the CDU data; (5.5) Take the sequence of the corrected and restored CDU size as the encrypted video correction fingerprint.

5. The method of claim 4, wherein the method is directed to HTTP / 2 traffic multiplexing features, and the step (6) comprises the following sub-steps: (6.1) Take out a video plaintext fingerprint from the video plaintext fingerprint database; (6.2) Initialization, set two sliding windows: correction fingerprint window and plaintext fingerprint window, where the correction fingerprint window slides on the encrypted video correction fingerprint in order, and its window size is always 1, the plaintext fingerprint window slides on the extracted video plaintext fingerprint, and its window size dynamically changes from 1 to x, and the matching error range is set to [-T T]. (6.3) compare the sum of data length in two windows, if the sum of data length in plaintext fingerprint window and the sum of data length in modified fingerprint window are in the error range [-T T], then consider them as matched, record the plaintext fingerprint sequence in plaintext fingerprint window and its corresponding video ID, otherwise, consider them as unmatched, plaintext fingerprint window continues to slide forward, until it slides to the tail of video plaintext fingerprint, plaintext fingerprint window size plus one, then start from the beginning again, until plaintext fingerprint window size reaches the upper limit x; (6.4) modified fingerprint window moves one position backward, repeat step (6.3) to match the next modified fingerprint segment; (6.5) after the matching of each segment of modified fingerprint and the extracted video plaintext fingerprint is completed, take out a new video plaintext fingerprint from the video plaintext fingerprint database again to enter step (6.2) for matching, until the plaintext fingerprints in the video plaintext fingerprint database are traversed, and the matching work is completed.

6. The method of claim 1, wherein the method is a method of encrypted video recognition oriented to HTTP / 2 traffic multiplexing features. The step (7) comprises the following sub-steps: (7.1) count the matching results of the modified fingerprint in step (6), and calculate the scores of each plaintext fingerprint with matching results; (7.2) take out the video plaintext fingerprint with the highest score and its corresponding video description information from the video plaintext fingerprint database as the encrypted video identification result.

Images