VPN (Virtual Private Network) encapsulated video title identification method based on video fragment characteristics

Abstract

The invention provides a VPN (Virtual Private Network) encapsulated video title recognition method based on video fragment characteristics, which is used for solving the problem of video title recognition in a VPN environment. The method comprises the following steps: firstly, carrying out fragmentation processing on a video stream, and extracting data length characteristics of each video during segmented transmission so as to generate a length characteristic sequence reflecting video contents; and secondly, constructing a lightweight CNN-LSTM model according to the characteristics of the feature sequence, and sending the feature sequence extracted from the VPN video stream traffic into the model for supervised training to obtain the CNN-LSTM model capable of accurately identifying the video title. Finally, an experimental result shows that the title of the VPN encrypted video can be accurately identified under the conditions of a complex network environment, massive background traffic and asymmetric routing, the method has relatively high identification accuracy and robustness, and technical support is provided for encrypted video identification in network traffic management and security monitoring.

Description

Technical Field

[0001] The invention provides a VPN encapsulated video title recognition method based on video segmentation characteristics, belonging to the technical field of network security and flow analysis. Background Art

[0002] With the popularization of the Internet and the rapid development of digital media technology, the proportion of video content in network traffic has continued to increase and has become a major component of data transmission. While this growth meets the entertainment needs of users, it also brings challenges to content management and network security, especially for the dissemination and management of bad or malicious video content. The dissemination of malicious video content not only poses a potential threat to user security, but also poses a severe test to the stability and legitimacy of the network environment, making the effective identification and management of video streams an urgent problem to be solved. However, some bad video content in the Internet environment may cause serious security problems, making the monitoring and identification of video content particularly critical. In actual applications, users are increasingly choosing to encrypt their network behavior through VPNs for the purpose of privacy protection and bypassing geographical restrictions, especially when accessing video content. VPNs can not only encrypt and encapsulate traffic, but also hide the user's actual network location to achieve a higher level of privacy protection. This encryption and secondary encapsulation method makes it difficult for traditional video stream identification technology to work.

[0003] At present, the research on the identification of encrypted video streams mainly focuses on TLS (Transport Layer Security Protocol) encrypted traffic, which is usually not re-encapsulated by VPN. Existing methods can identify TLS encrypted video streams through specific side channel features. However, when the video stream is re-encapsulated by VPN, these methods have certain limitations and are difficult to apply directly.

[0004] (1) Video recognition method based on video fingerprint library

[0005] The video fingerprint library method builds a fingerprint library and stores features such as the payload length and transmission order of the video stream as fingerprint data. The network layer and transport layer protocol headers carry some information related to the video application layer data, which can reveal the characteristics of the video content to a certain extent. Existing studies use the payload length and transmission order of the video application layer data as fingerprints to identify the video and build a fingerprint library for the target video. Later, when it is necessary to identify an encrypted video, the corresponding feature sequence can be extracted from the traffic and compared with the fingerprint in the fingerprint library. If the match is successful, the video can be identified based on the records in the fingerprint library. However, building and maintaining the fingerprint library requires a large amount of data and computing resources. In VPN-encapsulated video streams, since the protocol header information is encrypted, it is difficult to obtain available plaintext information, resulting in the inability to correct the length of the video clip, which brings errors to the fingerprint construction.

[0006] (2) Video recognition method based on burst mode

[0007] The burst pattern recognition method mainly relies on the periodic burst characteristics of the video stream during transmission, which is caused by the streaming media transmission mechanism and the client's buffering strategy. Usually, the video stream transmission will show a certain "ON-OFF" pattern, that is, the video data will be transmitted intensively in a short period of time (ON phase), and then enter a relatively idle state (OFF phase) until the client cache is insufficient again. This transmission pattern will show periodic traffic bursts in the network data packet, which becomes a feature basis for identifying the video content. In practical applications, researchers will analyze the burst frequency, burst duration, and burst interval of the video stream, and identify the video by pattern matching these features. However, due to the fluctuation of the network, the burst traffic characteristics will be unstable, resulting in a large number of obfuscated data packets in the ON phase. The existing burst pattern-based method does not consider the processing of obfuscated data packets, so this method is not suitable for video title recognition in VPN encapsulation scenarios.

[0008] (3) Video recognition method based on clustering model

[0009] The clustering model-based method mainly clusters the video stream features and classifies similar video stream features into the same category to achieve title recognition of encrypted video streams. This method does not require the title tag of the video to be known in advance, so it is suitable for video classification of unknown titles. However, the accuracy of video stream identification based on the clustering model depends on the quality and quantity of samples. When the samples are insufficient or unevenly distributed, the recognition effect may not be ideal. At the same time, this method is susceptible to interference when dealing with complex network environments, and has limitations because it does not consider the intrinsic characteristics of the video stream. Summary of the invention

[0010] In order to address the problem that the prior art cannot accurately identify video titles in a VPN encapsulation environment, the method proposed in the present invention provides an effective solution for identifying VPN encapsulated videos of multiple video platforms, and can effectively address the challenges in current cyberspace security requirements.

[0011] The present invention proposes a VPN video recognition method based on fragmentation features. Through the method of the present invention, the specific title of the encrypted and transmitted VPN video stream can be effectively identified in a complex network environment, solving the recognition problem caused by VPN secondary encryption. The recognition process of the present invention is divided into a training stage and an application stage. In the training stage, the present invention divides the video data into application data units (ADUs) based on the DASH and HLS transmission protocols of the video stream and extracts its stable length features. Specifically, by extracting the ADU length information of each video, a feature sequence consisting of a length value is generated as an identification feature of the video content for subsequent model training. Then, these length feature sequences are trained using a CNN-LSTM hybrid model to construct a model with video title recognition capabilities. In the application stage, the present invention first performs a preliminary filtering on the input video stream, eliminates irrelevant background traffic, and focuses on the target VPN video stream. Then, the ADU length feature sequence is extracted from each video to be identified, and is input into the trained CNN-LSTM model for title recognition. The CNN layer is used to capture local patterns in length feature sequences and extract subtle features in the sequences; the LSTM layer is responsible for processing the temporal relationship of the sequences and identifying the overall pattern of the video data in the time dimension. The method of the present invention can maintain high accuracy and robustness in a complex network environment, i.e., in the face of a large amount of background traffic and asymmetric routing conditions, and can recognize video titles in real time without affecting the normal transmission of other traffic or infringing on the user's privacy.

[0012] In order to achieve the purpose of the present invention, the specific technical steps of this scheme are as follows: A VPN encapsulated video title recognition method based on video segmentation characteristics, the method comprising the following steps:

[0013] Step (1) collecting video stream traffic data under VPN scenarios of different platforms, and obtaining currently public authoritative backbone network traffic data as background traffic;

[0014] Step (2) extracting the distribution sequences of the payload and packet interval of different platform data packets, and constructing the standard distribution sequence of VPN encrypted video stream for filtering the background stream;

[0015] Step (3) analyzing the segmented transmission mechanism of the media protocol, and obtaining the minimum payload length of the request video message and the minimum interval time between adjacent request video messages in the ON-OFF phase, for subsequent extraction of the request video message;

[0016] Step (4) based on the segmented transmission mechanism of the streaming media protocol, the video stream is segmented using the video action requested by the client to obtain the sequence features of the video segments;

[0017] Step (5) sends the segment sequence features to the CNN-LSTM model for training to obtain a model that can accurately identify VPN encrypted video titles.

[0018] Step (6) uses the recognition model obtained in step (5) and uses the video title as the recognition granularity to identify VPN video traffic in different platforms.

[0019] Furthermore, in step (1), the specific process of collecting data is as follows:

[0020] (1.1) To build a collection environment for capturing VPN video traffic data, you need one or more PCs and several network cables, deploy a VPN node on each PC, and play the required video;

[0021] (1.2) Write a web crawler script using Python or other programming tools to obtain URLs of different video platforms and aggregate them into URL files;

[0022] (1.3) Deploy a script program on each PC to automatically capture video messages;

[0023] (1.4) Download the authoritative backbone network dataset from the official website as background traffic;

[0024] Furthermore, in step (2), the standard distribution sequence method for constructing VPN encrypted video stream is as follows:

[0025] (2.1) Analyze the principle of the video stream protocol, and verify the existence of differences by performing characteristic statistics on the video stream messages and non-video type background stream messages obtained in step (1);

[0026] (2.2) extracting the data packet payload and packet interval distribution sequence, and finally generating a one-dimensional feature sequence containing the payload and packet interval distribution probability, which is used to describe the traffic characteristics;

[0027] (2.3) Filter the background stream by using the Euclidean distance and K-means clustering algorithm; divide the samples into multiple clusters by using the K-means algorithm and calculate the center point of each cluster. The average value of the cluster center point is used as the standard distribution sequence. The Euclidean distance between the sequence to be detected and the standard sequence is calculated. If the distance is less than or equal to the preset threshold, it is determined to be a VPN encrypted video stream; otherwise, it is determined to be a background stream.

[0028] Furthermore, in step (3), the specific process of extracting the request video message features is as follows:

[0029] (3.1) For different platforms, all request messages with a load greater than zero are extracted from the collected video traffic data.

[0030] (3.2) Counting the payload lengths of request messages on different platforms, and obtaining a payload length threshold min_requestLen for extracting request video messages;

[0031] (3.3) According to the streaming media transmission protocol, in the middle and late stages of video playback, the traffic pattern shows an ON-OFF pattern with a certain periodicity. In this pattern, the sending frequency of the request video message presents a specific time interval distribution characteristic. Based on this characteristic, the request message interval time in the ON-OFF stage of different platforms is counted to obtain the request time interval threshold min_requestTime used to determine whether to enter the ON-OFF stage and extract the request video message.

[0032] Furthermore, in step (4), the specific process of obtaining the video clip sequence features is as follows:

[0033] (4.1) In the early stage of video playback, the traffic pattern based on the streaming media transmission protocol shows the characteristics of continuous high-intensity data transmission. As the playback progresses, the traffic pattern gradually shows an ON-OFF pattern with periodic characteristics. First, determine whether it has entered the ON-OFF stage. When the arrival time interval of adjacent request messages is greater than the threshold min_requestTime obtained in (3.2), it is marked as entering the ON-OFF stage.

[0034] (4.2) Before entering the ON-OFF phase, only the threshold min_requestLen obtained in (3.2) is used to extract request messages, and request messages that meet the payload length condition are retained. After entering the ON-OFF phase, double screening is performed by combining min_requestLen and min_requestTime to extract request messages that meet the conditions.

[0035] (4.3) After extracting the request video message through step (4.2), subtract the ACK sequence numbers of adjacent request video messages to obtain a video segment length. Define a dynamic array Seq, add the obtained video segment length to the sequence Seq, and finally obtain a video segment sequence feature of a VPN encrypted video stream.

[0036] Furthermore, in step (5), the model for identifying VPN encrypted video titles is constructed as follows:

[0037] (5.1) Construct a CNN-LSTM hybrid model, which combines the deep learning model of convolutional neural network (CNN) and long short-term memory network (LSTM) to form a CNN-LSTM hybrid model. The spatial features of the video clip sequence extracted by CNN and the temporal dependency captured by LSTM are used to form a deep learning model suitable for video title recognition.

[0038] (5.2) Design the model architecture. The model consists of convolutional units, LSTM units and classification units. The convolutional units consist of Conv1D, BN and MP. The LSTM units model the time series characteristics. The classification units implement title classification through Dense and Softmax layers. ReLU is used to connect the units, and Dropout prevents overfitting.

[0039] (5.3) Training model. The CNN-LSTM model is trained through supervised learning, combining spatial and temporal features to learn the feature distribution of input video clips and achieve accurate classification of VPN encrypted video titles.

[0040] Furthermore, in step (6), the real-time identification process of the VPN video stream title in the backbone network is specifically as follows:

[0041] (6.1) The extracted feature sequence is input into the CNN-LSTM recognition model trained in step (5), and the video title is recognized in real time according to the classification results output by the model.

[0042] (6.2) Based on the classification results of the video titles, the identification granularity is further refined into specific VPN video stream titles. Especially when multi-platform scenarios are involved, accurate classification of specific titles for each platform is achieved.

[0043] (6.3) Record the identified VPN video stream titles, and mark, count or monitor the traffic of specific titles as needed to support real-time analysis of target video content in the backbone network.

[0044] Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

[0045] (1) Compared with the existing methods that need to extract multiple features and further process through complex calculations to distinguish between background flow and target flow, the present invention extracts the interval distribution probability value of the data packet payload length and the packet interval as the main features, and combines the Euclidean distance for feature matching, and only relies on a one-dimensional feature sequence to complete the filtering of the background flow. This method significantly reduces the computational complexity and memory resource consumption, making the feature extraction and filtering process more efficient.

[0046] (2) Compared with the existing methods that rely on bidirectional traffic for feature extraction, which easily leads to incomplete traffic under asymmetric routing conditions, the present invention uses unidirectional traffic as the feature extraction object and can achieve efficient feature analysis based only on the data in the request direction. This design avoids the problem of feature loss caused by the loss or incompleteness of bidirectional traffic, while ensuring good adaptability in scenarios where asymmetric routing phenomena are common, such as backbone networks.

[0047] (3) Compared with the existing methods that need to extract multiple features and perform complex calculations to process these features, the present invention combines feature extraction based on client requests, and only needs to obtain key features such as packet size and arrival time to construct an aggregate feature sequence. This method significantly simplifies the feature extraction process and greatly reduces the consumption of time and space resources, and is particularly suitable for high-speed and high-traffic scenarios such as backbone networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The system framework diagram of the VPN encapsulation video title recognition method based on video segmentation features;

[0049] Figure 2 A network topology diagram of a VPN encapsulation video title recognition method based on video segmentation features;

[0050] Figure 3 Figure 2. Traffic pattern of VPN video streaming from Dailymotion. DETAILED DESCRIPTION

[0051] The technical solution provided by the present invention will be described in detail below in conjunction with specific embodiments. It should be understood that the following specific implementation methods are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0052] Embodiment: The present invention provides a method for real-time identification of VPN video stream titles, the overall system structure of which is as follows: Figure 1 As shown, the following steps are included:

[0053] Step (1) collecting video stream traffic data under VPN scenarios of different platforms, and obtaining currently public authoritative backbone network traffic data as background traffic;

[0054] Step (2) extracting the distribution sequences of the payload and packet interval of different platform data packets, and constructing the standard distribution sequence of VPN encrypted video stream for filtering the background stream;

[0055] Step (3) analyzing the segmented transmission mechanism of the media protocol, and obtaining the minimum payload length of the request video message and the minimum interval time between adjacent request video messages in the ON-OFF phase, for subsequent extraction of the request video message;

[0056] Step (4) based on the segmented transmission mechanism of the streaming media protocol, the video stream is segmented using the video action requested by the client to obtain the sequence features of the video segments;

[0057] Step (5) sends the segment sequence features to the CNN-LSTM model for training to obtain a model that can accurately identify VPN encrypted video titles.

[0058] Step (6) uses the recognition model obtained in step (5) and uses the video title as the recognition granularity to identify VPN video traffic in different platforms.

[0059] In an implementation example of the present invention, in step (1), by collecting VPN video traffic, the VPN dataset Dailymotion_VPNvideo and the VPN dataset Twitter_VPNvideo of Twitter encrypted by Vmess can be finally obtained. By downloading from the official website, the background traffic dataset MAWI2 can be finally obtained. The steps of collecting data are as follows:

[0060] (1.1) Build the corresponding collection environment (such as Figure 2 ) to capture VPN video traffic data. We deploy a popular VPN tunnel encryption protocol client node, the Vmess client node, on the PC we use. The PC can control the use of the VPN node and the playback of the video. In addition, in order to ensure the authenticity of the data, we can use the campus network, home network and company network to complete the data collection work in this step;

[0061] (1.2) Select videos from several international popular video providers (Twitter, Facebook, Youtube, Dailymotion, etc.) as experimental objects, write web crawler scripts based on the characteristics of these providers' video platforms, obtain the URLs of videos on these platforms and summarize them into URL files;

[0062] (1.3) Deploy Uibot software on the PC and write an automated script program using Uibot Creator to complete the automated collection of video packets. The main tasks of the automated script program are: reading the URL file obtained in (1.2), controlling the PC browser to play the video according to the read URL, and controlling the PC to open Wireshark to capture packets and store the captured packets before playing the video. It should be noted that before capturing packets of the same video, the existing video cache data in the browser needs to be cleared;

[0063] (1.4) Obtain the public dataset of the MAWI working group, which consists of 900s traffic trajectories on the 10Gbps main IX link (WIDE to DIX-IE). The background traffic dataset composed of these datasets is named MAWI2.

[0064] In one example of the present invention, in step (2), the steps of extracting the distribution sequences of the payload and packet interval of different platform data packets and constructing the standard distribution sequence of VPN encrypted video stream for filtering the background stream are as follows:

[0065] (2.1) By analyzing the principle of video streaming protocol, it is found that due to the characteristics of video streaming with large data volume and periodic transmission, the distribution of packet payload and packet interval has certain commonalities, while non-video background traffic presents a more random distribution. These characteristics may cause the video stream and non-video background traffic to show differences at the packet level. Through analysis, it can be found that the differences are real.

[0066] (2.2) Extraction algorithm of data packet payload and packet interval distribution sequence: Set the threshold number of payload length interval rangePayload and packet interval interval rangeTime; group the data packets into streams according to the five-tuple information, traverse and extract the payload size and arrival interval time of each data packet; calculate the payload interval position m_len of each data packet, and count the number of data packets in the corresponding interval. Map the arrival interval time interval. Since the order of magnitude of the packet interval time is small, for the convenience of statistics, we can use the following formula to map the packet interval time.

[0067]

[0068] Calculate the corresponding interval position m_time and update the number of packets in the corresponding interval; calculate the distribution probability of each payload interval and packet interval; add the distribution probability of the payload interval and packet interval to the feature sequence Seq in turn to generate a one-dimensional feature sequence.

[0069] (2.3) Filter the background flow by Euclidean distance and K-means clustering algorithm: Use K-means clustering algorithm to extract the distribution sequence of payload and packet interval from the traffic samples of a specific video platform; divide the samples into n clusters, calculate the center point of each cluster; take the average value of the cluster center point as the standard distribution sequence S, which is used to represent the typical video flow characteristics of the platform. Calculate the Euclidean distance between the sequence to be detected Z and the standard sequence S: If the distance is less than or equal to the preset threshold max_distancemax, it is determined to be a VPN encrypted video flow; otherwise, it is determined to be a background flow.

[0070] The calculation formula of Euclidean distance is as follows, where X i ,Y i are the i-th elements in the X and Y sequences respectively, and k represents the length of the sequence.

[0071]

[0072] In one embodiment of the present invention, in step (3), the segmented transmission mechanism of the media protocol is analyzed, and the minimum payload length of the request video message and the minimum interval time between adjacent request video messages in the ON-OFF phase are statistically obtained. The specific process for subsequent extraction of the request video message is as follows:

[0073] (3.1) For different platforms, extract all request messages with a load greater than zero from the video traffic data collected in step (1).

[0074] (3.2) Perform statistical analysis on the payload length of the request messages extracted from each platform. First, perform frequency distribution statistics on the payload length of the request messages of each platform and draw a length distribution curve to identify the common payload length range. According to the main peak area of ​​the distribution curve, determine the payload length threshold min_requestLen used to distinguish the request video messages.

[0075] (3.3) According to the streaming media transmission protocol, in the middle and late stages of video playback, the traffic pattern shows an ON-OFF pattern with a certain periodicity. In this pattern, the frequency of sending video request messages shows a specific time interval distribution characteristic. To further analyze this characteristic, the request message intervals in the ON-OFF stage of each platform are statistically analyzed, the time intervals between adjacent request messages are recorded, the frequency distribution of the time intervals is calculated, and the time interval distribution curve is drawn. According to the high-frequency area of ​​the distribution curve, the time interval with the highest probability of occurrence is extracted as the request time interval threshold min_requestTime.

[0076] In one embodiment of the present invention, in step (4), 2538 and 2745 feature sequences are extracted from Dailymotion's VPN dataset Dailymotion_VPNvideo and Twitter's VPN dataset Twitter_VPNvideo, respectively. The specific process of extracting features to obtain a single feature sequence is as follows:

[0077] (4.1) In the early stage of video playback, the traffic pattern based on the streaming media transmission protocol shows the characteristics of continuous high-intensity data transmission. As the playback progresses, the traffic pattern gradually shows an ON-OFF pattern with periodic characteristics. The amount of data in an ON stage is the size of a video clip. First, initialize the ON-OFF stage flag to flag_ONOFF = False, and record the arrival time of the previous request message. Traverse the request video messages arranged in chronological order, calculate the time interval between adjacent request messages, and when the interval is greater than the threshold min_requestTime obtained in (3.2), mark the entry into the ON-OFF stage and set flag_ONOFF to True.

[0078] (4.2) Before entering the ON-OFF phase, only the threshold min_requestLen obtained in (3.2) is used to extract request messages, and messages with a payload length less than min_requestLen are eliminated. After entering the ON-OFF phase, double screening is performed by combining min_requestLen and min_requestTime to extract messages that simultaneously meet the requirements that the payload length is greater than or equal to min_requestLen and the time interval with the previous request message is greater than or equal to min_requestTime.

[0079] (4.3) After extracting the request video message through step (4.2), subtract the ACK sequence numbers of adjacent request video messages to obtain a video segment length. Define a dynamic array Seq, add the obtained video segment length to the sequence Seq, and finally obtain a video segment sequence feature of a VPN encrypted video stream. Figure 3 The traffic trace of 100sVPN video streaming from Dailymotion platform is shown. It shows that the traffic pattern of video streaming does have staged and periodic characteristics. In the early stage of video playback, the traffic pattern shows a continuous pattern of high-intensity data transmission. After a period of time, the traffic pattern shows an "ON-OFF" pattern with a certain periodicity;

[0080] In one embodiment of the present invention, in step (5), the specific process of training the classification model is as follows:

[0081] (5.1) Constructing a CNN-LSTM hybrid model. This study proposes a deep learning model that combines a convolutional neural network (CNN) and a long short-term memory network (LSTM). The CNN part is mainly used to extract spatial features in video clip sequences and effectively represent the spatial relationship of data by capturing local patterns; while the LSTM focuses on capturing the temporal dependencies in the sequence and can provide a deeper analysis of sequence characteristics by modeling the context.

[0082] (5.2) Design the model architecture. The model consists of three groups of convolutional units, two groups of LSTM units and a classification unit. Each group of convolutional units includes a one-dimensional convolution layer (Conv1D), a batch normalization layer (BN) and a maximum pooling layer (MP). Conv1D is responsible for extracting local spatial features, BN improves training efficiency and stability by standardizing features, and MP reduces feature dimensions while retaining key information. After the convolutional unit, the LSTM unit is used to model temporal dependencies and further extract deep patterns in sequence characteristics. The classification unit consists of a fully connected layer (Dense Layer) and a Softmax activation function, which is used to classify video titles. In addition, the ReLU activation function is used to connect each unit, and a Dropout layer is added after the LSTM layer to reduce the risk of overfitting.

[0083] (5.3) Training model. In the training phase, by feeding the features into the designed CNN-LSTM hybrid model, the model combines the spatial features extracted by CNN and the temporal dependencies captured by LSTM to learn the feature distribution of the input video clips, and finally achieve accurate classification of VPN encrypted video titles.

[0084] Table 1 CNN-LSTM model structure

[0085] Layer Type Structural details Conv-1 Conv1D(256,3,(x_train.shape[1],1))-BatchNormalization()-MaxPooling1D(2) Conv-2 Conv1D(128,3)-BatchNormalization()-MaxPooling1D(2) Conv-3 Conv1D(64,3)-BatchNormalization()-MaxPooling1D(2 LSTM-1 LSTM(192,return sequences=True)-Dropout(0.5) LSTM-2 LSTM(128) Dense Dense(n)

[0086] In one embodiment of the present invention, in step (6), the real-time identification process of the VPN video streaming platform in the backbone network is specifically as follows:

[0087] (6.1) By analyzing the traffic characteristics in the backbone network, the extracted VPN encrypted video clip sequence features are input into the CNN-LSTM recognition model. The feature extraction process divides the video traffic into Dailymotion videos with a length of about 3 minutes and Twitter video samples with a length of 40 seconds to 1 minute based on the payload size and time interval distribution, and generates sequences to input into the model;

[0088] (6.2) Combined with the traffic characteristics of Dailymotion and Twitter platforms, the time window and feature parameters of the model input sequence are adjusted to meet the recognition requirements of different video sample lengths. The model is optimized by independent training or sharing some parameters to further refine the granularity and achieve accurate classification across platforms and titles;

[0089] (6.3) The identified VPN encrypted video stream titles and platform information are recorded in the database for subsequent query and verification. At the same time, the traffic distribution of different titles is quantitatively analyzed by combining statistical tools. Table 2 shows the recognition results of these two different platforms.

[0090] Table 2 Recognition results in different video platforms

[0091]

[0092] It should be noted that the above embodiments are not intended to limit the protection scope of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions all fall within the protection scope of the claims of the present invention.

Claims

1. A VPN encapsulated video title recognition method based on video segmentation features, characterized in that: The method comprises the following steps: Step (1) collecting video stream traffic data under VPN scenarios of different platforms, and obtaining currently public authoritative backbone network traffic data as background traffic; Step (2) extracting the payload and packet interval distribution sequences of data packets on different platforms, and constructing the distribution probability values ​​as feature sequences for distinguishing video streams from background traffic; Step (3) analyzing the segmented transmission mechanism of the media protocol, and obtaining the minimum payload length of the request video message and the minimum interval time between adjacent request video messages in the ON-OFF phase, for subsequent extraction of the request video message; Step (4) based on the segmented transmission mechanism of the streaming media protocol, the video stream is segmented using the video action requested by the client to obtain the sequence features of the video segments; Step (5) sends the segment sequence features to the CNN-LSTM model for training to obtain a model that can accurately identify VPN encrypted video titles. Step (6) uses the recognition model obtained in step (5) and uses the video title as the recognition granularity to identify VPN video traffic in different platforms.

2. The VPN encapsulated video title recognition method based on video fragmentation characteristics according to claim 1 is characterized in that: The step (1) specifically comprises the following sub-steps: (1.1) To build a collection environment for capturing VPN video traffic data, you need one or more PCs and several network cables, deploy a VPN node on each PC, and play the required video; (1.2) Write a web crawler script using Python or other programming tools to obtain URLs of different video platforms and aggregate them into URL files; (1.3) Deploy a script program on each PC to automatically capture video messages; (1.4) Download the authoritative backbone network dataset from the official website as background traffic.

3. The VPN encapsulated video title recognition method based on video fragmentation characteristics according to claim 1 is characterized in that: The step (2) specifically comprises the following sub-steps: (2.1) Analyze the principle of the video stream protocol, and verify the existence of differences by performing characteristic statistics on the video stream messages and non-video type background stream messages obtained in step (1); (2.2) extracting the data packet payload and packet interval distribution sequence, and finally generating a one-dimensional feature sequence containing the payload and packet interval distribution probability, which is used to describe the traffic characteristics; (2.3) The background flow is filtered using the Euclidean distance and K-means clustering algorithm.

4. The VPN encapsulated video title recognition method based on video fragmentation characteristics according to claim 1 is characterized in that: The step (3) specifically comprises the following sub-steps: (3.1) For different platforms, extract all request messages with a load greater than zero from the collected video traffic data. (3.2) Count the payload lengths of request messages on different platforms to obtain a payload length threshold min_requestLen for extracting request video messages. (3.3) According to the streaming media transmission protocol, in the middle and late stages of video playback, the traffic pattern shows an ON-OFF mode with a certain periodicity. In this mode, the sending frequency of the request video message presents a specific time interval distribution characteristic. Based on this characteristic, the request message interval time in the ON-OFF stage of different platforms is counted to obtain the request time interval threshold min_requestTime used to determine whether to enter the ON-OFF stage and extract the request video message.

5. The VPN encapsulated video title recognition method based on video fragmentation characteristics according to claim 1 is characterized in that: The step (4) specifically comprises the following sub-steps: (4.1) In the early stage of video playback, the traffic pattern based on the streaming media transmission protocol presents the characteristics of continuous high-intensity data transmission. As the playback progresses, the traffic pattern gradually presents an ON-OFF pattern with periodic characteristics. First, it is determined whether to enter the ON-OFF stage. When the arrival time interval of adjacent request messages is greater than the threshold min_requestTime obtained in (3.2), it is marked as entering the ON-OFF stage. (4.2) Before entering the ON-OFF phase, only the threshold min_requestLen obtained in (3.2) is used to extract request messages, and request messages that meet the payload length condition are retained. After entering the ON-OFF phase, double screening is performed by combining min_requestLen and min_requestTime to extract request messages that meet the condition. (4.3) After extracting the request video message through step (4.2), subtract the ACK sequence numbers of adjacent request video messages to obtain a video segment length, define a dynamic array Seq, add the obtained video segment length to the sequence Seq, and finally obtain a video segment sequence feature of a VPN encrypted video stream.

6. A method for real-time identification of VPN video streaming platforms in a backbone network according to claim 1, characterized in that: The step (5) specifically comprises the following sub-steps: (5.1) Construct a CNN-LSTM hybrid model, combining the spatial features of video clip sequences extracted by CNN with the temporal dependencies captured by LSTM to form a deep learning model suitable for video title recognition. (5.2) Design the model architecture. The model consists of convolutional units, LSTM units and classification units. The convolutional units consist of Conv1D, BN and MP. The LSTM units model the time series characteristics. The classification units implement title classification through Dense and Softmax layers. ReLU is used to connect the units. Dropout prevents overfitting. (5.3) Training model, through supervised learning, the CNN-LSTM model is trained, combining spatial and temporal features to achieve the classification task of VPN encrypted video titles.

7. The VPN encapsulated video title recognition method based on video segmentation characteristics according to claim 1 is characterized in that: The step (6) specifically comprises the following sub-steps: (6.1) The extracted feature sequence is input into the CNN-LSTM recognition model trained in step (5), and the video title is recognized in real time according to the classification results output by the model. (6.2) Based on the classification results of the video titles, the identification granularity is further refined into specific VPN video stream titles. Especially when multi-platform scenarios are involved, accurate classification of specific titles for each platform is achieved. (6.3) Record the identified VPN video stream titles, and mark, count or monitor the traffic of specific titles as needed to support real-time analysis of target video content in the backbone network.

Images