A VPN-encapsulated video title recognition method based on video fragmentation characteristics

Abstract

The present invention proposes a VPN encapsulated video title recognition method based on video fragmentation features to solve the problem of video title recognition in VPN environments. First, the method fragments the video stream and extracts the data length features of each video during segmented transmission to generate a length feature sequence reflecting the video content. Secondly, a lightweight CNN-LSTM model is constructed based on the characteristics of the feature sequence, and the feature sequence extracted from the VPN video stream traffic is fed into the model for supervised training to obtain a CNN-LSTM model that can accurately identify video titles. Finally, experimental results show that the present invention can accurately identify the titles of VPN encrypted videos under complex network environments, massive background traffic, and asymmetric routing conditions, with high recognition accuracy and robustness, providing technical support for encrypted video recognition in network traffic management and security monitoring.

Description

Technical Field

[0001] The invention provides a VPN encapsulated video title recognition method based on video fragmentation characteristics, belonging to the technical field of network security and flow analysis. Background Art

[0002] With the increasing popularity of the internet and the rapid development of digital media technologies, video content has continuously increased its share of network traffic and has become a major component of data transmission. While this growth satisfies users' entertainment needs, it also presents challenges in content management and network security, particularly regarding the dissemination of inappropriate or malicious video content. The spread of malicious video content not only poses a potential threat to user safety but also severely challenges the stability and legitimacy of the network environment, making the effective identification and management of video streams a pressing issue. However, certain inappropriate video content in the internet environment can cause serious security issues, making the monitoring and identification of video content particularly critical. In practice, users are increasingly using VPNs to encrypt their network traffic, particularly when accessing video content, to protect their privacy and circumvent geographic restrictions. VPNs not only encrypt and encapsulate traffic but also conceal the user's actual network location, achieving a higher level of privacy protection. This encryption and secondary encapsulation method makes traditional video stream identification technologies ineffective.

[0003] Currently, research on identifying encrypted video streams primarily focuses on TLS (Transport Layer Security) encrypted traffic, which typically does not undergo secondary VPN encapsulation. Existing methods can identify TLS-encrypted video streams using specific side-channel signatures. However, these methods have limitations and are difficult to directly apply when the video stream is re-encapsulated by VPN.

[0004] (1) Video recognition method based on video fingerprint library

[0005] The video fingerprint library method constructs a fingerprint library and stores features such as the payload length and transmission order of the video stream as fingerprint data. The network layer and transport layer protocol headers carry some information related to the video application layer data, which can reveal the characteristics of the video content to a certain extent. Existing research uses the payload length and transmission order of the video application layer data as fingerprints to identify videos and constructs a fingerprint library for the target video. Later, when it is necessary to identify an encrypted video, the corresponding feature sequence can be extracted from the traffic and compared with the fingerprint in the fingerprint library. If a match is successful, the video can be identified based on the records in the fingerprint library. However, building and maintaining the fingerprint library requires a large amount of data and computing resources. In VPN-encapsulated video streams, since the protocol header information is encrypted, it is difficult to obtain usable plaintext information, resulting in the inability to correct the length of the video clip, which introduces errors in fingerprint construction.

[0006] (2) Video recognition method based on burst pattern

[0007] Burst pattern recognition methods primarily rely on the periodic burst characteristics of video streams during transmission, which are caused by the streaming media transmission mechanism and the client's buffering strategy. Typically, video stream transmission exhibits a specific "on-off" pattern: video data is transmitted in a short period of time (the "on phase"), followed by a relatively idle state (the "off phase") until the client buffer is insufficient and transmission resumes. This transmission pattern manifests as periodic traffic bursts in network packets, which serve as a characteristic basis for identifying video content. In practical applications, researchers analyze burst frequency, burst duration, and burst intervals in video streams and use pattern matching to identify videos. However, network fluctuations can cause unstable burst traffic characteristics, resulting in a large number of obfuscated packets during the "on phase." Existing burst pattern-based methods do not consider the handling of obfuscated packets, making them unsuitable for video title recognition in VPN encapsulation scenarios.

[0008] (3) Video recognition method based on clustering model

[0009] Clustering-based methods primarily cluster video stream features, grouping similar video stream features into the same category to achieve title recognition in encrypted video streams. This method does not require prior knowledge of the video's title tags and is therefore suitable for classifying videos with unknown titles. However, the accuracy of video stream identification using clustering-based methods depends on the quality and quantity of samples. When samples are insufficient or unevenly distributed, the recognition effect may be suboptimal. Furthermore, this method is susceptible to interference when dealing with complex network environments and has limitations due to its failure to consider the inherent characteristics of the video stream. Summary of the Invention

[0010] To address the problem of the inability of existing technologies to accurately identify video titles in VPN-encapsulated environments, the method proposed in this invention provides an effective solution for identifying VPN-encapsulated videos on multiple video platforms, effectively addressing the challenges of current cyberspace security requirements.

[0011] The present invention proposes a VPN video recognition method based on fragmentation features. This method can effectively identify the specific titles of encrypted VPN video streams in complex network environments, resolving the recognition challenges associated with VPN secondary encryption. The recognition process of the present invention is divided into a training phase and an application phase. During the training phase, the present invention divides video data into application data units (ADUs) based on the DASH and HLS transmission protocols used for video streams and extracts their stable length features. Specifically, by extracting the ADU length information for each video, a feature sequence consisting of length values ​​is generated as an identification feature of the video content for subsequent model training. These length feature sequences are then trained using a CNN-LSTM hybrid model to construct a model capable of video title recognition. During the application phase, the present invention first performs preliminary filtering on the input video stream to eliminate irrelevant background traffic and focus on the target VPN video stream. Next, the ADU length feature sequence is extracted from each video to be identified and input into the trained CNN-LSTM model for title recognition. The CNN layer is used to capture local patterns in length-featured sequences and extract subtle features within them; the LSTM layer is responsible for processing the temporal relationships of the sequences and identifying the overall temporal patterns of the video data. The method of the present invention maintains high accuracy and robustness in complex network environments, particularly those facing large amounts of background traffic and asymmetric routing conditions. It can identify video titles in real time without affecting the normal transmission of other traffic or infringing on users' privacy.

[0012] To achieve the purpose of the present invention, the specific technical steps of this solution are as follows: A VPN encapsulated video title identification method based on video fragment characteristics, the method comprising the following steps:

[0013] Step (1) collecting video stream traffic data under different platform VPN scenarios and obtaining the currently public authoritative backbone network traffic data as background traffic;

[0014] Step (2) extracting the distribution sequences of data packet payloads and packet intervals of different platforms, and constructing a standard distribution sequence of VPN encrypted video streams for filtering background streams;

[0015] Step (3) analyzing the segmented transmission mechanism of the media protocol, and obtaining the minimum payload length of the request video message and the minimum interval time between adjacent request video messages in the ON-OFF phase, for subsequent extraction of the request video message;

[0016] Step (4) based on the segmented transmission mechanism of the streaming media protocol, the video stream is segmented using the video action requested by the client to obtain the sequence features of the video segments;

[0017] Step (5) sends the segment sequence features into the CNN-LSTM model for training to obtain a model that can accurately identify VPN encrypted video titles.

[0018] Step (6) uses the recognition model obtained in step (5) and uses the video title as the recognition granularity to identify VPN video traffic in different platforms.

[0019] Furthermore, in step (1), the specific process of collecting data is as follows:

[0020] (1.1) Setting up a collection environment to capture VPN video traffic data requires one or more PCs and several network cables. Deploy a VPN node on each PC and play the required video.

[0021] (1.2) Write a web crawler script using Python or other programming tools to obtain URLs from different video platforms and aggregate them into a URL file;

[0022] (1.3) Deploy a script program on each PC to automatically capture video packets;

[0023] (1.4) Download the authoritative backbone network dataset from the official website as background traffic;

[0024] Furthermore, in step (2), the standard distribution sequence method for constructing VPN encrypted video stream is as follows:

[0025] (2.1) Analyze the principle of the video stream protocol and verify the existence of differences by performing characteristic statistics on the video stream packets and non-video background stream packets obtained in step (1);

[0026] (2.2) Extract the data packet payload and packet interval distribution sequence, and finally generate a one-dimensional feature sequence containing the payload and packet interval distribution probability to describe the traffic characteristics;

[0027] (2.3) Filter the background stream using the Euclidean distance and K-means clustering algorithm; divide the samples into multiple clusters using the K-means algorithm and calculate the center point of each cluster. The average value of the cluster center point is used as the standard distribution sequence, and the Euclidean distance between the sequence to be detected and the standard sequence is calculated. If the distance is less than or equal to the preset threshold, it is determined to be a VPN encrypted video stream; otherwise, it is determined to be a background stream.

[0028] Furthermore, in step (3), the specific process of extracting the request video message features is as follows:

[0029] (3.1) For different platforms, extract all request messages with a load greater than zero from the collected video traffic data.

[0030] (3.2) Counting the payload lengths of request messages on different platforms to obtain a payload length threshold min_requestLen for extracting request video messages;

[0031] (3.3) According to the streaming media transmission protocol, during the middle and late stages of video playback, the traffic pattern exhibits a periodic ON-OFF pattern. In this pattern, the frequency of sending video request packets exhibits a specific time interval distribution characteristic. Based on this characteristic, the request packet intervals during the ON-OFF phase of different platforms are statistically analyzed to obtain the request interval threshold min_requestTime, which is used to determine whether the ON-OFF phase has entered and extract video request packets.

[0032] Furthermore, in step (4), the specific process of obtaining the video clip sequence features is as follows:

[0033] (4.1) In the initial stages of video playback, the traffic pattern based on the streaming media transmission protocol exhibits the characteristics of continuous, high-intensity data transmission. As playback progresses, the traffic pattern gradually exhibits a periodic ON-OFF pattern. First, determine whether it has entered the ON-OFF phase. When the time interval between the arrival of consecutive request messages is greater than the threshold min_requestTime obtained in (3.2), it is marked as entering the ON-OFF phase.

[0034] (4.2) Before entering the ON-OFF phase, only request messages are extracted based on the min_requestLen threshold obtained in (3.2), and request messages that meet the payload length condition are retained. After entering the ON-OFF phase, double screening is performed based on min_requestLen and min_requestTime to extract request messages that meet the conditions.

[0035] (4.3) After extracting the video request message in step (4.2), subtract the ACK sequence numbers of adjacent video request messages to obtain a video segment length. Define a dynamic array Seq and add the obtained video segment length to the sequence Seq. Ultimately, the video segment sequence characteristics of a VPN encrypted video stream are obtained.

[0036] Furthermore, in step (5), the model for identifying VPN encrypted video titles is constructed as follows:

[0037] (5.1) Construct a CNN-LSTM hybrid model. This model combines the deep learning models of convolutional neural networks (CNN) and long short-term memory networks (LSTM). CNN extracts spatial features of video clip sequences and LSTM captures temporal dependencies to form a deep learning model suitable for video title recognition.

[0038] (5.2) Design the model architecture. The model consists of convolutional units, LSTM units, and classification units. The convolutional units consist of Conv1D, BN, and MP. The LSTM units model time series characteristics. The classification units implement title classification through Dense and Softmax layers. ReLU is used to connect the units, and Dropout prevents overfitting.

[0039] (5.3) Model Training. The CNN-LSTM model is trained through supervised learning, combining spatial and temporal features to learn the feature distribution of the input video clips and achieve accurate classification of VPN encrypted video titles.

[0040] Furthermore, in step (6), the real-time identification process of the VPN video stream title in the backbone network is specifically as follows:

[0041] (6.1) The extracted feature sequence is input into the CNN-LSTM recognition model trained in step (5), and the video title is recognized in real time based on the classification results output by the model.

[0042] (6.2) Based on the classification results of the video titles, the recognition granularity is further refined into specific VPN video stream titles. Especially when multi-platform scenarios are involved, accurate classification of specific titles of each platform is achieved.

[0043] (6.3) Record the identified VPN video stream titles, and mark, count or monitor the traffic of specific titles as needed to support real-time analysis of target video content in the backbone network.

[0044] Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

[0045] (1) Compared to existing methods that require extracting multiple features and further processing through complex calculations to distinguish between background and target traffic, the present invention extracts the interval distribution probability values ​​of the packet payload length and packet interval as the main features, and combines them with Euclidean distance for feature matching. It can complete the filtering of background traffic based solely on a one-dimensional feature sequence. This method significantly reduces computational complexity and memory resource consumption, making the feature extraction and filtering process more efficient.

[0046] (2) Compared to existing methods that rely on bidirectional traffic for feature extraction, which can easily lead to incomplete traffic under asymmetric routing conditions, the present invention uses unidirectional traffic as the feature extraction object and can achieve efficient feature analysis based only on data from the request direction. This design avoids the problem of feature loss caused by lost or incomplete bidirectional traffic, while ensuring good adaptability in scenarios where asymmetric routing is prevalent, such as backbone networks.

[0047] (3) Compared to existing methods that require extracting multiple features and performing complex calculations to process these features, this invention combines feature extraction based on client requests, only requiring key features such as packet size and arrival time to construct an aggregated feature sequence. This approach significantly simplifies the feature extraction process and significantly reduces the consumption of time and space resources, making it particularly suitable for high-speed, high-traffic scenarios such as backbone networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a system framework diagram of a VPN encapsulated video title recognition method based on video segmentation features;

[0049] Figure 2 Network topology diagram for VPN encapsulation video title recognition method based on video segmentation characteristics;

[0050] Figure 3 Figure 2 shows the traffic pattern of VPN video streaming from Dailymotion. DETAILED DESCRIPTION

[0051] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0052] Embodiment: The present invention provides a method for real-time identification of VPN video stream titles, the overall system structure of which is as follows: Figure 1 As shown, the following steps are included:

[0053] Step (1) collecting video stream traffic data under different platform VPN scenarios and obtaining the currently public authoritative backbone network traffic data as background traffic;

[0054] Step (2) extracting the distribution sequences of data packet payloads and packet intervals of different platforms, and constructing a standard distribution sequence of VPN encrypted video streams for filtering background streams;

[0055] Step (3) analyzing the segmented transmission mechanism of the media protocol, and obtaining the minimum payload length of the request video message and the minimum interval time between adjacent request video messages in the ON-OFF phase, for subsequent extraction of the request video message;

[0056] Step (4) based on the segmented transmission mechanism of the streaming media protocol, the video stream is segmented using the video action requested by the client to obtain the sequence features of the video segments;

[0057] Step (5) sends the segment sequence features into the CNN-LSTM model for training to obtain a model that can accurately identify VPN encrypted video titles.

[0058] Step (6) uses the recognition model obtained in step (5) and uses the video title as the recognition granularity to identify VPN video traffic in different platforms.

[0059] In one embodiment of the present invention, in step (1), by collecting VPN video traffic, the VPN dataset Dailymotion_VPNvideo and the VPN dataset Twitter_VPNvideo encrypted by Vmess can be obtained. By downloading from the official website, the background traffic dataset MAWI2 can be obtained. The steps for collecting data are as follows:

[0060] (1.1) Build the corresponding collection environment (such as Figure 2 ) to capture VPN video traffic data. We deployed a Vmess client node, a popular VPN tunnel encryption protocol, on the PC we were using. The PC could control the use of the VPN node and video playback. Furthermore, to ensure data authenticity, we used campus, home, and company networks to complete data collection in this step.

[0061] (1.2) Select videos from several internationally popular video providers (Twitter, Facebook, YouTube, Dailymotion, etc.) as experimental subjects. Based on the characteristics of these providers' video platforms, write a web crawler script to obtain the URLs of videos on these platforms and summarize them into a URL file;

[0062] (1.3) Deploy Uibot software on the PC and write an automated script using Uibot Creator to complete the automated collection of video packets. The main tasks of this automated script are: reading the URL file obtained in (1.2), controlling the PC browser to play the video according to the read URL, and controlling the PC to open Wireshark to capture the packets and store the captured packets before playing the video. It should be noted that before capturing the packets of the same video, the existing video cache data in the browser needs to be cleared;

[0063] (1.4) Obtain the public dataset of the MAWI working group, which consists of 900s traffic traces on the 10Gbps main IX link (WIDE to DIX-IE). The background traffic dataset composed of these datasets is named MAWI2.

[0064] In one embodiment of the present invention, in step (2), the steps of extracting the distribution sequences of the payload and packet interval of different platform data packets and constructing the standard distribution sequence of VPN encrypted video stream for filtering the background stream are as follows:

[0065] (2.1) Analysis of the principles of video streaming protocols reveals that due to the large amount of data transmitted and periodic transmission, the distribution of packet payloads and inter-packet intervals share certain commonalities. However, non-video background traffic exhibits a more random distribution. These characteristics may lead to differences between video and non-video background traffic at the packet level. Analysis confirms that these differences are real.

[0066] (2.2) Algorithm for extracting the distribution sequence of packet payload and inter-packet intervals: Set the threshold number for the payload length interval rangePayload and the packet interval interval rangeTime; group the packets into streams based on the five-tuple information, traverse and extract the payload size and inter-arrival time of each packet; calculate the payload interval position m_len of each packet and count the number of packets in the corresponding interval. Map the inter-arrival time interval. Since the inter-packet time is of a small order of magnitude, for statistical convenience, we can use the following formula to map the inter-packet time.

[0067]

[0068] Calculate the corresponding interval position m_time and update the number of packets in the corresponding interval; calculate the distribution probability of each payload interval and packet interval; add the distribution probability of the payload interval and packet interval to the feature sequence Seq in sequence to generate a one-dimensional feature sequence.

[0069] (2.3) Filtering background traffic using Euclidean distance and K-means clustering: Using the K-means clustering algorithm, we extract the distribution sequences of payload and inter-packet intervals from traffic samples from a specific video platform. We then divide the samples into n clusters and calculate the center point of each cluster. The average of the cluster centers is used as the standard distribution sequence S, representing the typical video stream characteristics of that platform. We then calculate the Euclidean distance between the sequence to be tested, Z, and the standard sequence S. If the distance is less than or equal to the preset threshold, max_distancemax, the stream is identified as VPN encrypted; otherwise, it is identified as background traffic.

[0070] The calculation formula of Euclidean distance is as follows, where X i ,Y i are the i-th element in the X and Y sequences respectively, and k represents the length of the sequence.

[0071]

[0072] In one embodiment of the present invention, in step (3), the segmented transmission mechanism of the media protocol is analyzed, and the minimum payload length of the request video message and the minimum interval time between adjacent request video messages in the ON-OFF phase are statistically obtained. The specific process for subsequent extraction of the request video message is as follows:

[0073] (3.1) For different platforms, extract all request messages with a load greater than zero from the video traffic data collected in step (1).

[0074] (3.2) Statistically analyze the payload lengths of request messages extracted from each platform. First, perform frequency distribution statistics on the payload lengths of request messages from each platform and plot a length distribution curve to identify common payload length ranges. Based on the main peak area of ​​the distribution curve, determine the payload length threshold min_requestLen used to distinguish video request messages.

[0075] (3.3) According to the streaming media transmission protocol, in the middle and late stages of video playback, the traffic pattern exhibits a periodic ON-OFF pattern. In this pattern, the frequency of sending video request messages exhibits a specific time interval distribution characteristic. To further analyze this characteristic, a statistical analysis of the request message intervals in the ON-OFF phase of each platform was performed. The time intervals between adjacent request messages were recorded, the frequency distribution of the time intervals was calculated, and a time interval distribution curve was plotted. Based on the high-frequency region of the distribution curve, the time interval with the highest probability of occurrence was extracted as the request time interval threshold min_requestTime.

[0076] In one embodiment of the present invention, in step (4), 2538 and 2745 feature sequences were extracted from Dailymotion's VPN dataset Dailymotion_VPNvideo and Twitter's VPN dataset Twitter_VPNvideo, respectively. The specific process of extracting features to obtain a single feature sequence is as follows:

[0077] (4.1) In the early stages of video playback, the traffic pattern based on the streaming media transmission protocol exhibits the characteristics of continuous high-intensity data transmission. As the playback progresses, the traffic pattern gradually shows an ON-OFF pattern with periodic characteristics. The amount of data in an ON phase is the size of a video clip. First, initialize the ON-OFF phase flag to flag_ONOFF = False, and record the arrival time of the previous request message. Traverse the request video messages arranged in chronological order, calculate the time interval between adjacent request messages, and when the interval is greater than the threshold min_requestTime obtained in (3.2), mark the entry into the ON-OFF phase and set flag_ONOFF to True.

[0078] (4.2) Before entering the ON-OFF phase, only request messages are extracted based on the threshold min_requestLen obtained in (3.2), and messages with payload lengths less than min_requestLen are eliminated. After entering the ON-OFF phase, a double screening is performed based on min_requestLen and min_requestTime, extracting messages that both meet the requirements of payload length greater than or equal to min_requestLen and time interval with the previous request message greater than or equal to min_requestTime.

[0079] (4.3) After extracting the video request message in step (4.2), subtract the ACK sequence numbers of adjacent video request messages to obtain a video segment length. Define a dynamic array Seq and add the obtained video segment length to the sequence Seq. Ultimately, the video segment sequence characteristics of a VPN encrypted video stream are obtained. Figure 3 The traffic trace of a 100sVPN video stream from the Dailymotion platform is presented. It shows that the traffic pattern of the video stream does exhibit both periodic and cyclical characteristics. In the early stages of video playback, the traffic pattern exhibits a continuous pattern of high-intensity data transmission. Over time, the traffic pattern exhibits an "on-off" pattern with a certain degree of cyclicality.

[0080] In one embodiment of the present invention, in step (5), the specific process of training the classification model is as follows:

[0081] (5.1) Constructing a CNN-LSTM Hybrid Model. This study proposes a deep learning model that combines a convolutional neural network (CNN) and a long short-term memory network (LSTM). The CNN is primarily used to extract spatial features from video clip sequences, effectively representing spatial relationships in the data by capturing local patterns. The LSTM, on the other hand, focuses on capturing temporal dependencies within the sequence, providing deeper analysis of sequence characteristics by modeling context.

[0082] (5.2) Design the model architecture. The model consists of three groups of convolutional units, two groups of LSTM units, and a classification unit. Each group of convolutional units includes a one-dimensional convolution layer (Conv1D), a batch normalization layer (BN), and a maximum pooling layer (MP). Conv1D is responsible for extracting local spatial features, BN improves training efficiency and stability by standardizing features, and MP reduces feature dimensions while retaining key information. After the convolutional unit, the LSTM unit is used to model temporal dependencies and further extract deep patterns in sequence characteristics. The classification unit consists of a fully connected layer (Dense Layer) and a Softmax activation function, which is used to classify video titles. In addition, the ReLU activation function is used to connect each unit, and a Dropout layer is added after the LSTM layer to reduce the risk of overfitting.

[0083] (5.3) Model Training. During the training phase, features are fed into the designed CNN-LSTM hybrid model. The model combines the spatial features extracted by the CNN with the temporal dependencies captured by the LSTM to learn the feature distribution of the input video clips, ultimately achieving accurate classification of VPN encrypted video titles.

[0084] Table 1 CNN-LSTM model structure

[0085] Layer Type Structural details Conv-1 Conv1D(256,3,(x_train.shape[1],1))-BatchNormalization()-MaxPooling1D(2) Conv-2 Conv1D(128,3)-BatchNormalization()-MaxPooling1D(2) Conv-3 Conv1D(64,3)-BatchNormalization()-MaxPooling1D(2 LSTM-1 LSTM(192,return sequences=True)-Dropout(0.5) LSTM-2 LSTM(128) Dense Dense(n)

[0086] In one embodiment of the present invention, in step (6), the real-time identification process of the VPN video streaming platform in the backbone network is as follows:

[0087] (6.1) By analyzing traffic characteristics in the backbone network, the extracted sequence features of VPN encrypted video clips are fed into the CNN-LSTM recognition model. The feature extraction process divides the video traffic into Dailymotion videos (approximately 3 minutes in length) and Twitter videos (40 seconds to 1 minute in length) based on payload size and time interval distribution, generating sequence inputs for the model.

[0088] (6.2) Taking into account the traffic characteristics of Dailymotion and Twitter platforms, the time window and feature parameters of the model input sequence are adjusted to adapt to the recognition requirements of different video sample lengths. By independently training or sharing some parameters to optimize the model, the granularity is further refined to achieve accurate classification across platforms and titles.

[0089] (6.3) The identified VPN encrypted video stream titles and platform information are recorded in a database for subsequent query and verification. At the same time, statistical tools are used to quantitatively analyze the traffic distribution of different titles. Table 2 shows the recognition results for two different platforms.

[0090] Table 2 Recognition results in different video platforms

[0091]

[0092] It should be noted that the above embodiments are not intended to limit the scope of protection of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions fall within the scope of protection of the claims of the present invention.

Claims

1. A VPN encapsulated video title recognition method based on video fragmentation features, characterized in that: The method comprises the following steps: Step (1) collects video stream traffic data under different platform VPN scenarios and obtains the currently public authoritative backbone network traffic data as background traffic; Step (2) extracts the payload and packet interval distribution sequences of data packets on different platforms, and constructs the distribution probability values ​​into feature sequences to distinguish video streams from background traffic; Step (3) analyzing the segmented transmission mechanism of the media protocol, and obtaining the minimum payload length of the request video message and the minimum interval time between adjacent request video messages in the ON-OFF phase, for subsequent extraction of the request video message; Step (4) Based on the segmented transmission mechanism of the streaming media protocol, the video stream is segmented using the client's request video action to obtain the sequence features of the video segments; Step (5) feeding the segment sequence features into the CNN-LSTM model for training to obtain a model that can accurately identify VPN encrypted video titles; Step (6) uses the recognition model obtained in step (5) and uses the video title as the recognition granularity to identify VPN video traffic in different platforms; Wherein, the step (3) specifically includes the following sub-steps: (3.1) For different platforms, extract all request messages with a load greater than zero from the collected video traffic data. (3.2) Count the payload lengths of request messages on different platforms and obtain the payload length threshold min_requestLen for extracting the request video message. (3.3) According to the streaming media transmission protocol, in the middle and late stages of video playback, the traffic pattern shows a periodic ON-OFF pattern. In this pattern, the frequency of sending video request packets shows a specific time interval distribution characteristic. Based on this characteristic, the request packet interval time in the ON-OFF stage of different platforms is counted to obtain the request interval threshold min_requestTime used to determine whether to enter the ON-OFF stage and extract the video request packet; The step (4) specifically includes the following sub-steps: (4.1) In the initial stage of video playback, the traffic pattern based on the streaming media transmission protocol shows the characteristics of continuous high-intensity data transmission. As the playback progresses, the traffic pattern gradually shows an ON-OFF pattern with periodic characteristics. First, it is determined whether it has entered the ON-OFF stage. When the arrival time interval of adjacent request messages is greater than the threshold min_requestTime obtained in (3.2), it is marked as entering the ON-OFF stage. (4.2) Before entering the ON-OFF phase, only the request message is extracted based on the threshold min_requestLen obtained in (3.2), and the request message that meets the payload length condition is retained. After entering the ON-OFF phase, double screening is performed based on min_requestLen and min_requestTime to extract the request message that meets the condition. (4.3) After extracting the request video message through step (4.2), subtract the ACK sequence numbers of adjacent request video messages to obtain a video segment length, define a dynamic array Seq, add the obtained video segment length to the sequence Seq, and finally obtain the video segment sequence feature of a VPN encrypted video stream.

2. The VPN encapsulated video title recognition method based on video fragmentation characteristics according to claim 1 is characterized in that: The step (1) specifically includes the following sub-steps: (1.1) Setting up a collection environment to capture VPN video traffic data requires one or more PCs and several network cables. Deploy a VPN node on each PC and play the required video. (1.2) Use Python or other programming tools to write web crawler scripts to obtain URLs from different video platforms and compile them into a URL file; (1.3) Deploy a script program on each PC to automatically capture video packets; (1.4) Download the authoritative backbone network dataset from the official website as background traffic.

3. The VPN encapsulated video title recognition method based on video fragmentation characteristics according to claim 1 is characterized in that: The step (2) specifically includes the following sub-steps: (2.1) Analyze the principle of the video streaming protocol and verify the existence of differences by performing characteristic statistics on the video streaming packets and non-video background streaming packets obtained in step (1); (2.2) Extract the data packet payload and packet interval distribution sequence, and finally generate a one-dimensional feature sequence containing the payload and packet interval distribution probability to describe the traffic characteristics; (2.3) Filter the background flow using Euclidean distance and K-means clustering algorithm.

4. The method for real-time identification of VPN video streaming platforms in a backbone network according to claim 1, characterized in that: The step (5) specifically includes the following sub-steps: (5.1) Construct a CNN-LSTM hybrid model, combining the spatial features of video clip sequences extracted by CNN with the temporal dependencies captured by LSTM to form a deep learning model suitable for video title recognition. (5.2) Design the model architecture. The model consists of convolutional units, LSTM units, and classification units. The convolutional units are composed of Conv1D, BN, and MP. The LSTM units model the time series characteristics. The classification units implement title classification through Dense and Softmax layers. ReLU is used to connect the units. Dropout prevents overfitting. (5.3) Training model, through supervised learning, the CNN-LSTM model is trained, combining spatial and temporal features to achieve the classification task of VPN encrypted video titles.

5. The VPN encapsulated video title recognition method based on video fragmentation characteristics according to claim 1 is characterized in that: The step (6) specifically includes the following sub-steps: (6.1) Input the extracted feature sequence into the CNN-LSTM recognition model trained in step (5), and perform real-time recognition of the video title based on the classification results output by the model. (6.2) Based on the classification results of the video titles, the identification granularity is further refined into specific VPN video stream titles. When multiple platforms are involved, the specific titles of each platform are accurately classified. (6.3) Record the identified VPN video stream titles and, based on requirements, mark, count, or monitor the traffic of specific titles to support real-time analysis of target video content in the backbone network.

Images