A method and device for identifying a DASH video based on a dynamic programming-based QUIC protocol

Abstract

This application provides a dynamic programming-based method and apparatus for identifying DASH videos using the QUIC protocol, relating to the field of network encrypted traffic identification technology. It constructs a plaintext fingerprint database covering target videos at different resolutions and encoding formats; filters QUIC traffic conforming to the video transmission domain name rules of the target video platform, and segments it into audio-video segment combination sequences. Ciphertext features are extracted from these audio-video segment combination sequences, and after correction processing, a transmission fingerprint is formed as a reference sequence. The reference sequence is then compared with video and audio segment sequences in the plaintext fingerprint database through rapid filtering, three-dimensional dynamic programming matching, matching segment expansion, and quantitative scoring, outputting the identification result. This allows for stable, accurate, and efficient identification of target DASH videos from encrypted, multiplexed, and audio-video mixed transmission traffic, addressing the technical challenge of difficult video content identification in the current field of cyberspace security governance.

Description

Technical Field

[0001] This application relates to the field of network encrypted traffic identification technology, and more specifically, to a method and apparatus for DASH video recognition based on the QUIC protocol using dynamic programming. Background Technology

[0002] With the rapid development of Internet technology, video traffic has become a major component of network data transmission, accounting for the vast majority of global Internet traffic. Large video platforms, represented by YouTube, serve as massive content distribution centers. While providing information services, they also pose a risk of spreading harmful videos. Effective identification and supervision of video content is an important task for purifying cyberspace. Currently, mainstream video platforms generally use encrypted transmission, which greatly increases the difficulty of video content identification while protecting privacy. The conventional approach to identifying target videos from network traffic is to pre-build a target video feature library, extract traffic features during the monitoring phase, and match them with the feature library to complete the identification. Existing methods are divided into two categories. (1) Identification method based on plaintext fingerprint library: fingerprint is constructed using DASH slice size sequence, and the encrypted features are corrected and matched with the plaintext fingerprint. However, this method relies on MPD file parsing or Range header to obtain plaintext slice information. (2) Identification method based on encrypted fingerprint library: encrypted traffic statistical features are collected and combined with deep learning models such as CNN and RNN for identification. It does not require obtaining the plaintext content of the video.

[0003] Existing technologies suffer from the following insurmountable defects: First, the QUIC protocol's multiplexing mechanism disrupts the temporal correspondence between transmission features and video segments, resulting in the parallel transmission of multiple audio and video segment streams over the same connection, rendering all TCP-based identification schemes ineffective. Second, platform protection mechanisms are continuously upgraded, with MPD files subject to strict access control and dynamic obfuscation, rendering traditional parsing methods ineffective; the QUIC protocol has abandoned the Range field, making it impossible to directly obtain the segment size even after decrypting the traffic. Third, existing QUIC identification schemes have inherent limitations: plaintext fingerprinting schemes rely on alternating audio and video requests, while current platforms employ a fully parallel acquisition strategy, making it impossible to distinguish between audio and video data, thus causing the scheme to fail; deep learning schemes rely on statistical features, are susceptible to feature drift due to network conditions and client versions, require massive amounts of labeled data, have high computational complexity, are black-box and uninterpretable, making them difficult to deploy on lightweight edge devices. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a dynamic programming-based QUIC protocol DASH video recognition method and apparatus, which can stably, accurately and efficiently identify target DASH video from encrypted, multiplexed, and audio-video mixed transmission traffic.

[0005] In a first aspect, embodiments of this application provide a QUIC protocol DASH video recognition method based on dynamic programming, the method comprising the following steps: Construct a plaintext fingerprint database covering target videos at different resolutions and encoding formats; QUIC traffic that conforms to the video transmission domain name rules of the target video platform is filtered out and segmented into audio and video segment combination sequences. Ciphertext features are extracted from the audio and video segment combination sequences, and after correction processing, a transmission fingerprint is formed as a reference sequence. The system performs rapid filtering, three-dimensional dynamic programming matching, matching segment expansion, and quantitative scoring on the baseline sequence and video and audio slice sequences in the plaintext fingerprint database, and outputs the recognition results.

[0006] In some embodiments, constructing a plaintext fingerprint database covering the target video at different resolutions and encoding formats includes the following steps: Using the target video VID as input, obtain four types of audio and video resources with different resolutions and encoding formats: MP4 video, MP4 audio, WebM video, and WebM audio. Based on the native slicing strategy of the video platform, the slice size sequence of various audio and video is extracted to form a basic fingerprint; After preprocessing the slice-sized sequence, multi-dimensional statistical features of the sequence are calculated to form an extended fingerprint; the statistical features include the number of sequences, extreme values, mean, variance, quartiles, and mode; The basic fingerprint is associated with the extended fingerprint and bound to metadata including VID and itag, and stored in the plaintext fingerprint database.

[0007] In some embodiments, the process of filtering QUIC traffic that conforms to the video transmission domain name rules of the target video platform, segmenting it into a sequence of combined audio and video segments, extracting ciphertext features from the sequence of combined audio and video segments, and forming a transmission fingerprint after correction processing includes the following steps: Based on the servername information in the TLS extension field during the QUIC handshake phase, the QUIC traffic used for video transmission by the target video platform is filtered out. For the filtered QUIC traffic, the continuously transmitted data is divided into a sequence of audio and video segments corresponding to a single request, using the client-initiated request as the dividing boundary. Ciphertext features are extracted from the audio and video segment combination sequence; the ciphertext features include a ciphertext length feature sequence and a data packet quantity statistical feature; The extracted ciphertext features were modified using a regression analysis model to form a transmission fingerprint, which served as a baseline sequence.

[0008] In some embodiments, quick filtering includes the following steps: The audio and video fingerprints in the plaintext fingerprint database are grouped by VID, and the video fingerprint and audio fingerprint combination under each VID is traversed and a preliminary comparison is made with the baseline sequence. For each VID-based combined fingerprint, the difference between the baseline sequence and the plaintext fingerprint extended features is calculated in each dimension. If the difference exceeds a preset threshold, a mismatch is determined and the process is skipped. If the difference meets the preset threshold, subsequent three-dimensional dynamic programming matching is triggered.

[0009] In some embodiments, when performing three-dimensional dynamic programming matching: Using a reference sequence Sequence to be matched and the sequence to be matched A baseline, two-to-match, three-sequence system; wherein, the sequences to be matched are... The sequence of bytes in a plaintext video slice is the sequence to be matched. Given a sequence of bytes for a plaintext audio slice, and , The number of video slices. This represents the number of audio slices. Set matching constraints, including a byte error threshold to constrain the maximum allowable deviation between the audio and video slice combination and the baseline sequence element; as well as the range of the number of video slice combinations, the range of the number of audio slice combinations, audio and video slice index constraints, and the effective continuous matching length threshold. An anchor point mechanism based on step size sampling is adopted; wherein, the reference sequence A is selected at equal intervals with a fixed step size, and three-dimensional dynamic programming matching is performed with each anchor point as an independent starting position; A sparse three-dimensional state storage is adopted; where the state triple state=(i,j,k) is the key, i is the current index of the baseline sequence A, j is the current index of the sequence to be matched B, and k is the current index of the sequence to be matched C; and dp[(i,j,k)]=(L,prev_state) is the value, where L is the length of continuous matching and prev_state is the predecessor state that represents the current state (i,j,k).

[0010] In some embodiments, three-dimensional dynamic programming matching includes the following steps: Starting from the anchor point as the reference sequence matching starting point, the legal indices of the sequence to be matched B and the sequence to be matched C are traversed according to the audio and video slice index constraints. Within the range of video slice combination and audio slice combination, the length of the legal combination is enumerated. The error between the number of combination bytes and the elements of the reference sequence is calculated. If the byte error threshold is met, a seed state is generated and recorded in the sparse three-dimensional state space. The matching path is expanded layer by layer according to the index increment direction of the baseline sequence A. For each current state, legal slice combinations are enumerated under the range of combination quantity and index constraints to satisfy the byte error constraint, generate a new state, update the sparse three-dimensional state space according to the optimal matching principle, and save the predecessor state information. Iterate through the matching results corresponding to all anchor points, select the state with the longest continuous matching length as the global optimal termination state, and backtrack based on the predecessor state to obtain the complete matching path.

[0011] In some embodiments, matching segment expansion and quantitative scoring include the following steps: The global optimal path is expanded to the left by the byte error threshold, and to the right by first widening it by twice the byte error threshold, and then continuously expanded by restoring the byte error threshold to determine the final matching segment interval. A comprehensive score is calculated by combining the cumulative matching length of the matching segment, the matching rate of the encrypted fingerprint within the matching segment, the matching rate of the video fingerprint within the matching segment, and the matching rate of the audio fingerprint within the matching segment; if the comprehensive score reaches the recognition threshold, the match is considered successful.

[0012] Secondly, embodiments of this application provide a QUIC protocol DASH video recognition device based on dynamic programming, the device comprising: The building module is used to construct a plaintext fingerprint library covering target videos at different resolutions and encoding formats; The correction module is used to filter QUIC traffic that conforms to the video transmission domain name rules of the target video platform, and segment it into a sequence of audio and video segments. It also extracts ciphertext features from the audio and video segment combination sequence, and forms a transmission fingerprint after correction processing, which serves as a reference sequence. The matching module is used to quickly filter, perform three-dimensional dynamic programming matching, expand the matching segment, and quantize the video and audio slice sequences in the plaintext fingerprint database against the baseline sequence, and output the recognition results.

[0013] Thirdly, an electronic device provided in this application includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the dynamic programming-based QUIC protocol DASH video recognition method described in any of the first aspects are executed.

[0014] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the dynamic programming-based QUIC protocol DASH video recognition method described in any of the first aspects.

[0015] This application describes a dynamic programming-based QUIC protocol DASH video recognition method and apparatus. It constructs a plaintext fingerprint database covering target videos at different resolutions and encoding formats; filters QUIC traffic conforming to the target video platform's video transmission domain name rules, and segments it into audio-video segment combination sequences. Ciphertext features are extracted from these sequences, corrected, and used to form a transmission fingerprint as a reference sequence. The reference sequence is then compared with video and audio segment sequences in the plaintext fingerprint database using rapid filtering, three-dimensional dynamic programming matching, matching segment expansion, and quantization scoring to output the recognition result. This method stably, accurately, and efficiently identifies target DASH videos from encrypted, multiplexed, and audio-video mixed transmission traffic, addressing the technical challenge of difficult video content recognition in current cyberspace security governance. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of the QUIC protocol DASH video recognition method based on dynamic programming according to an embodiment of this application is shown; Figure 2 This document illustrates a flowchart of the process for constructing a plaintext fingerprint database covering target videos at different resolutions and encoding formats, as described in an embodiment of this application. Figure 3 The flowchart illustrates an embodiment of this application that extracts ciphertext features from the audio and video segment combination sequence, and after correction processing, forms a transmission fingerprint as a reference sequence. Figure 4 A flowchart illustrating a rapid screening process according to an embodiment of this application is shown; Figure 5 A flowchart illustrating the three-dimensional dynamic programming matching process in an embodiment of this application is shown; Figure 6 This paper shows a schematic diagram of the structure of the QUIC protocol DASH video recognition device based on dynamic programming according to an embodiment of this application; Figure 7 A structural block diagram of the electronic device described in an embodiment of this application is shown. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0019] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0020] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0021] In view of the technical problems raised in the background art, this application provides a method and apparatus for DASH video recognition based on dynamic programming using the QUIC protocol, which can stably, accurately and efficiently identify target DASH video from encrypted, multiplexed, and audio-video mixed transmission traffic.

[0022] See the instruction manual appendix Figure 1 This application provides a QUIC protocol DASH video recognition method based on dynamic programming, comprising the following steps: S1. Construct a plaintext fingerprint database covering target videos at different resolutions and encoding formats; S2. Filter QUIC traffic that conforms to the video transmission domain name rules of the target video platform, and segment it to obtain a sequence of audio and video segments. Extract ciphertext features from the sequence of audio and video segments, and form a transmission fingerprint after correction processing, which serves as a reference sequence. S3. Perform rapid filtering, three-dimensional dynamic programming matching, matching segment expansion, and quantitative scoring on the baseline sequence and video and audio slice sequences in the plaintext fingerprint database, and output the recognition results.

[0023] Mainstream video platforms (such as YouTube and Facebook) commonly use adaptive streaming technology to transmit video content. To achieve DASH video recognition based on the QUIC protocol, a plaintext fingerprint database covering the target video at different resolutions and encoding formats needs to be constructed first. This fingerprint database is used to characterize the true audio and video slice features of the video in plaintext mode, providing basic data support for subsequent video recognition and matching based on QUIC encrypted traffic. See the appendix to the manual. Figure 2 The construction of a plaintext fingerprint database covering target videos at different resolutions and encoding formats includes the following steps: S101. Using the target video VID as input, obtain four types of audio and video resources with different resolutions and encoding formats: MP4 video, MP4 audio, WebM video, and WebM audio. S102. According to the native slicing strategy of the video platform, extract the slice size sequence of various audio and video to form a basic fingerprint; S103. After preprocessing the slice-sized sequence, calculate the multi-dimensional statistical features of the sequence to form an extended fingerprint; the statistical features include the number of sequences, extreme values, mean, variance, quartiles, and mode. S104. Associate the basic fingerprint with the extended fingerprint and bind it with metadata including VID and itag, and store it in the plaintext fingerprint database.

[0024] Specifically, in step S101, the unique video identifier (VID) of the target video is used as an input parameter. The VID is a unique string assigned to each video by the video platform. For example, for a YouTube video link https: / / www.youtube.com / watch?v=wu-tBDhmkB4, its corresponding VID is wu-tBDhmkB4. Then, based on the input VID, the corresponding video's metadata (including but not limited to resolution, encoding format, etc.) is extracted through the video platform's public interface or compliant data collection tools, and the complete audio and video resources of the video in different resolutions and encoding formats supported by the platform are downloaded. Currently, the audio and video files provided by mainstream online platforms can be categorized into four types: MP4 video files, MP4 audio files, WebM video files, and WebM audio files.

[0025] In step S102, for the four types of audio and video files downloaded above, a customized DASH slice feature extractor is used to extract the slice size sequence of each file according to the original video slicing strategy (which is consistent with the platform's slicing granularity). This sequence directly reflects the slicing results of the audio and video resources under the platform's slicing strategy, and constitutes the basic fingerprint of the video.

[0026] In step S103, in order to transform the audio and video slice size sequence into numerical features that can be used for fast matching, the original slice size sequence is first preprocessed (including removing the first and last slices to exclude initialization and special data at the end, scaling, etc.). Then, based on the original sequence or the preprocessed sequence, the number, extreme values, mean, variance, quartiles, mode and other multi-dimensional statistical features of the sequence are calculated. These statistical measures together constitute the extended fingerprint of the video, which is used for rapid initial screening in the candidate video library.

[0027] In step S104, the basic fingerprint (audio and video slice size sequence) is associated with the extended fingerprint (multi-dimensional statistical features). After binding the video's VID, itag and other metadata information, it is stored in the plaintext fingerprint database to support subsequent fast retrieval and deep matching.

[0028] In step S2, since the QUIC protocol uses an encrypted transmission mechanism, it is impossible to directly obtain the plaintext information of the audio and video content. Therefore, it is necessary to extract ciphertext features from the network traffic that can be matched with the plaintext fingerprint. (See the appendix to the instruction manual.) Figure 3 The process of filtering QUIC traffic that conforms to the video transmission domain name rules of the target video platform, segmenting it into a sequence of audio and video segments, extracting ciphertext features from the sequence of audio and video segments, and forming a transmission fingerprint after correction processing includes the following steps: S201. Based on the servername information in the TLS extension field during the QUIC handshake phase, filter out the QUIC traffic used for video transmission by the target video platform; S202. For the filtered QUIC traffic, using the client-initiated request as the dividing boundary, divide the continuously transmitted data into a sequence of audio and video segments corresponding to a single request. S203. Extract ciphertext features from the audio and video segment combination sequence; the ciphertext features include a ciphertext length feature sequence and a data packet quantity statistical feature; S204. The extracted ciphertext features are corrected using a regression analysis model to form a transmission fingerprint, which serves as the baseline sequence.

[0029] Specifically, in step S201, network traffic is collected using a network packet capture tool. Based on the servername information in the TLS extension field carried during the QUIC Initial handshake phase, QUIC traffic that conforms to the video transmission domain name rules of the target video platform is filtered out, thereby locating the video transmission stream related to the target platform.

[0030] In step S202, for the filtered QUIC traffic, the continuously transmitted data is divided into audio and video segment combination sequences corresponding to a single request, using the client-initiated request as the segmentation boundary. This is used to characterize the actual transmission characteristics of audio and video slices in the QUIC multiplexing transmission environment.

[0031] In step S203, ciphertext features are extracted from the audio and video segment combination sequence, including but not limited to the ciphertext length feature sequence of the audio and video combined data unit, and statistical features such as the number of data packets obtained based on the UDP bearer layer statistics, which are used to characterize the transmission behavior characteristics of audio and video segments under encrypted transmission.

[0032] In step S204, based on the pre-built regression analysis model, the ciphertext length feature sequence is modified to eliminate the influence of transmission mechanism factors such as protocol encryption, multiplexing, and data encapsulation on the audio and video segment length, so that the modified features are as close as possible to the original audio and video segment length, forming a modified fingerprint for subsequent matching, i.e., a transmission fingerprint.

[0033] Through the above processing, the audio and video combined ciphertext features extracted from QUIC encrypted traffic are modified into a transmission fingerprint that can statistically characterize the transmission characteristics of audio and video segment combinations. However, because the QUIC protocol uses a multiplexing mechanism, audio and video segments may be interleaved or have different combination methods during transmission. Therefore, it is difficult to reliably match the transmission fingerprint with the audio and video combined fingerprint in the plaintext fingerprint database through a simple one-dimensional sequential comparison.

[0034] Therefore, this application proposes a three-sequence collaborative fingerprint matching method based on dynamic programming. Using a modified fingerprint as the base sequence, and combining plaintext video and audio slice sequences, it achieves accurate matching and video recognition between transmitted fingerprints and plaintext fingerprint combinations through a combination of rapid filtering and dynamic programming, i.e., executing step S3. Specifically, this application addresses the problem of parallel transmission of audio and video slices due to multiplexing in the QUIC protocol, and the need for a single encrypted fingerprint to match a massive number of plaintext fingerprint combinations. It designs a three-stage matching process: first, candidate combinations are reduced through rapid filtering; second, matching segments are accurately calculated through three-dimensional dynamic programming; and finally, scoring and judgment are performed based on the features of the matching segments to obtain accurate recognition results.

[0035] The rapid screening stage is used to perform preliminary judgment on the encrypted fingerprint and each audio / video combination fingerprint in the plaintext fingerprint database, so as to narrow down the candidate range of dynamic programming matching, improve matching efficiency, and trigger precise matching calculation. In one embodiment, see the appendix to the specification. Figure 4 Quick filtering includes the following steps: S301. Group the audio and video fingerprints in the plaintext fingerprint database according to VID, and traverse the video fingerprint and audio fingerprint combination under each VID group to perform a preliminary comparison with the baseline sequence. S302. For the combined fingerprint under each VID, calculate the difference value between the baseline sequence and the plaintext fingerprint extended features in each dimension; if the difference value exceeds the preset threshold, determine that there is no match and skip it; if the difference value meets the preset threshold, trigger the subsequent three-dimensional dynamic programming matching.

[0036] Specifically, in step S301, the audio and video fingerprints in the plaintext fingerprint database are grouped by video VID. Under each VID group, the combination of video fingerprint and audio fingerprint is traversed one by one, and the ciphertext fingerprint to be matched is initially compared with the group of combined fingerprints.

[0037] In step S302, for each VID-based combined fingerprint, the differences in extended features (such as mean, variance, extreme values, quartiles, etc.) between the ciphertext fingerprint and the plaintext fingerprint are calculated across all dimensions. If the difference exceeds a preset threshold, the combination is deemed impossible to match and skipped, with the next combined fingerprint being checked. If the difference meets the threshold, a preliminary match is considered possible, triggering the next precise matching calculation. That is, for the combined fingerprints that pass the rapid screening, three-dimensional dynamic programming matching is performed to calculate the matching length and matching score. When the matching score reaches a preset recognition threshold, the ciphertext fingerprint is considered to have successfully matched the plaintext fingerprint, thus determining its corresponding video VID, and the matching result is immediately output. After a successful match, the matching operation for subsequent combined fingerprints is terminated, without needing to continue traversing other combinations.

[0038] The above process can quickly trigger precise matching of dynamic programming while avoiding complex calculations for impossible matching combinations, ensuring accurate matching results and high computational efficiency.

[0039] Before introducing the process of three-dimensional dynamic programming matching, it should be noted that this application constructs a three-sequence matching system of "one benchmark and two matching targets", and clarifies the core parameters and constraints, which are specifically defined as follows: benchmark sequence QUI transmits the corrected fingerprint sequence, denoted as sequence. , length is The element represents the number of bytes in the combined audio and video segments after processing by the corresponding transport layer.

[0040] Sequence to be matched Plaintext video slice byte sequence ,in The number of video slices. For the video number The length of each slice in bytes; Sequence to be matched Plaintext audio slice byte sequence ,in The number of audio slices. For audio number Each slice is byte long; typically, (That is, the number of video slices is about twice the number of audio slices). Matching objective: To construct a three-sequence collaborative matching model based on byte number error constraints, while maintaining the continuity and order consistency within the three sequences, to search for a continuous collaborative segment with the longest matching length, so that the continuous segment of sequence A matches the continuous segments of sequences B and C in the sense of byte combination.

[0041] At the same time, the sequence combination sum is defined as the sequence to be matched. The total byte length after combining local contiguous slices is the core computational amount for state transitions, specifically including: Video segment combination: extract From index in sequence The beginning Each element, namely The sum of their combinations is ; Audio combination segment: Take From index in sequence The beginning Each element, namely The sum of their combinations is ; Coordinated Combination: The total byte length of the audio / video combined segment, expressed as: ; Matching error: The absolute value of the difference between the sum of elements in the cooperative combination and the reference sequence, expressed as follows: ; For sequence Calculate the prefix sums separately: ; ; Using prefix sums, we can... To obtain the sum of any interval within a given time period and avoid repeated summations, the formula is as follows: Video Combination Segment

[0042] Audio Combination Segment

[0043] And, the byte error threshold, denoted as This is used to constrain the maximum allowed byte deviation between a single audio / video slice combination and its corresponding QUIC fingerprint element. When the matching error... If the value is less than this, the matching unit is considered to have matched successfully; The range of video slice combinations: denoted as This indicates the upper and lower limits of the number of video slices that can be combined in a matching unit, with a default value of [missing information]. ,in This is to support matching scenarios consisting only of audio slices; The range of audio slice combination quantity: denoted as This indicates the upper and lower limits of the number of audio slices that can be combined in a matching unit, with a default value of [missing information]. ,in This is to support matching scenarios consisting solely of video slices; Audio / video slice index constraints: taking into account the number of video slices in an actual DASH video. Usually more than the number of audio slices Furthermore, by statistically analyzing the relationship between audio and video slice indices in actual audio and video slice requests, the video slice index was analyzed. With audio slice index Apply constraints: , in This indicates the floor function; Valid continuous matching length threshold: denoted as This is used to determine the validity of the matching result. It represents the number of consecutive successfully matched units in a given matching path. satisfy If the matching path is not valid, the consecutive matching segments are determined to be valid segments; otherwise, they are discarded.

[0044] In addition, the uncertainty of the initial alignment and the necessity of matching non-zero starting points are explained. In the actual video playback and QUIC transmission environment, the plaintext video slice sequence, plaintext audio slice sequence and QUIC transmission correction fingerprint sequence are often difficult to be strictly aligned at the starting point of time. If the synchronization matching is forced from the starting position of the three sequences, the matching success rate will be significantly reduced. The specific reasons include, but are not limited to: (1) Adaptive resolution and dynamic encoding switching problem. At the beginning of video playback, the client is usually in the network status detection and adaptive adjustment stage. The player may adaptively switch between different resolutions and corresponding bitrates. Therefore, the actual requested slice sequence may dynamically switch between multiple different representation layer fingerprint sequences in the plaintext fingerprint library, making it difficult for the current transmission starting point to be stably aligned with the starting position of any fixed plaintext fingerprint sequence, increasing the uncertainty of the starting segment matching. (2) QUIC connection reconstruction and stream switching problem. During video playback, affected by network fluctuations, connection reset or platform scheduling strategies, the original QUIC connection may be interrupted and re-established, and new video data continues to be transmitted through another QUIC stream. At this time, the starting position of the ciphertext fingerprint sequence corresponding to the newly established QUIC transport stream does not correspond to the starting position of the plaintext fingerprint sequence of the target video. The two are misaligned on the time axis and cannot be matched by a simple starting alignment method. (3) Automatic continuous playback and stream multiplexing problem. After the video playback ends, the platform often automatically plays the next recommended video. In some implementations, the data of the new video may still reuse the original QUIC connection for transmission, resulting in the continuous carrying of data content of multiple different videos in the same QUIC transport stream. In this case, the starting position of the plaintext fingerprint sequence corresponding to the target video may be mapped to the middle area of ​​the ciphertext fingerprint sequence, and the ciphertext fingerprint sequence may also contain the transmission data of the previous video. The two cannot form a one-to-one correspondence at the starting point of time.

[0045] Therefore, this application does not adopt the method of global alignment matching from the starting position of the three sequences. Instead, it introduces a non-zero starting point matching mechanism based on anchor points. Multiple anchor points are sampled in the reference sequence A according to a preset step size as candidate matching starting points. Three-dimensional dynamic programming matching is performed with each anchor point as an independent starting position. In this way, even in the presence of uncertain starting points, stream switching and content splicing, it can still stably capture real continuous matching segments and achieve reliable identification of the target video.

[0046] Among them, the target sequence According to the preset fixed step size Perform equal-interval sampling and select several index positions as matching anchor points. Anchor points are used to define the starting position of the dynamic programming search, thereby significantly reducing the overall search space while ensuring matching integrity. The set of anchor points can be represented as... For each anchor point Each sequence position serves as an independent starting reference point for matching, and subsequent multi-sequence matching processes are executed accordingly to obtain multiple candidate matching results. The anchor step size is set to default. The anchor point selection strategy can be adjusted based on sequence length and matching accuracy to balance computational efficiency and matching completeness. This strategy is specifically designed for real-world transmission scenarios such as uncertain starting positions, stream switching, and automatic continuous playback, and is used to locate potential matching regions under unknown starting point conditions.

[0047] Furthermore, this application adopts a "sparse three-dimensional state" design, storing only valid matching states, thus avoiding the problem of excessive space complexity in traditional dense arrays. The specific definition is as follows: (1) State triples: Define state triples Its three dimensions correspond to the current matching positions of the three sequences, and their specific meanings are as follows: : benchmark sequence The index of the current element to be matched, i.e., the next element to be matched. ,in ; Video slice sequence The starting index of the current consecutive segment to be matched, i.e., the next segment to be matched, is from... In the beginning, among them ; Audio slice sequence The starting index of the current consecutive segment to be matched, i.e., the next segment to be matched, is from... In the beginning, among them .

[0048] (2) State reachability constraints: In state The algorithm then enumerates the lengths of all consecutive segments that satisfy the conditions. This makes: video slice sequence fragments and audio slice sequence fragments The sum and the elements of the reference sequence It meets the preset error threshold requirement in terms of byte size, that is .

[0049] In this embodiment, a dictionary structure in key-value pair form is used. The reachable state information generated during dynamic programming is stored. The state dictionary is expressed in the following form:

[0050] Among them, state triples As a key, it represents the baseline sequence in the current matching process. Video slice sequence and audio slice sequences The current index position to be matched; the value is a tuple. , Indicates from a certain matching anchor point Begin with state As the current state, it represents the number of consecutively successfully matched units, i.e., the length of the current matching path; Indicates reaching the current state The direct predecessor state is used to backtrack and construct the complete matching path after the matching is completed.

[0051] When multiple different matching paths can reach the same state At that time, only retain the one with the longest matching length. The state information is used to ensure that the matching path corresponding to each state is the optimal path under the current conditions.

[0052] Simultaneously, path tracing information is recorded through an auxiliary dictionary, specifically defined as follows: Precursor parameter dictionary The expression is:

[0053] Its function is to record the state of the predecessor. Transition to the current state hour, Combination length of sequences and Combination length of sequences This provides combined information for path backtracking.

[0054] Anchor Point Identifier Dictionary The expression is:

[0055] Its function is to record the current state. The baseline sequence of the corresponding matching path Initial matching anchor position It is used to quickly determine the matching segment in the baseline sequence after matching is completed. The starting position in.

[0056] The following is in conjunction with the instruction manual appendix. Figure 5 The process of three-dimensional dynamic programming matching is explained, including the following steps: S303. Using the anchor point as the starting point for the baseline sequence matching, traverse the legal indices of the sequence to be matched B and the sequence to be matched C according to the audio and video slice index constraints. Enumerate the length of the legal combination within the range of video slice combination and audio slice combination. Calculate the error between the number of combination bytes and the elements of the baseline sequence. If the byte error threshold is met, generate the seed state and record it in the sparse three-dimensional state space. S304. Expand the matching path layer by layer according to the index increment direction of the baseline sequence A. For each current state, enumerate the legal slice combinations under the range of combination quantity and index constraints, satisfy the byte error constraint, generate a new state, update the sparse three-dimensional state space according to the optimal matching principle, and save the predecessor state information. S305. Traverse all matching results corresponding to anchor points, select the state with the longest continuous matching length as the global optimal termination state, and backtrack based on the predecessor state to obtain the complete matching path.

[0057] In step S303, for the reference sequence A certain anchor point position The algorithm uses this anchor point as the starting reference point for matching, constructing an initial set of reachable states to provide starting states for subsequent matching path expansion. The seed state initialization process only constructs the initial set of reachable states for the current anchor point, and the state spaces corresponding to each anchor point are independent of each other. The specific steps are as follows: Before entering the matching calculation of the current anchor point, the state dictionary is initialized. Its auxiliary storage structure is empty and used to store the reachability information of the current anchor point. At the anchor point... Under fixed conditions, traverse Sequence Index and Sequence Index And ensure that the audio and video slice index constraints are met. Based on this, iterate through the lengths of valid combinations: , and ensure that the requirements are met. and And audio / video slice index constraints; for each pair of candidate combinations Calculate the corresponding synergistic combinations and And verify the error constraints If a certain initial matching combination When the above constraints are met, the corresponding seed state is generated: and initialize its state value as follows:

[0058] Indicates from the anchor point Departure, first successful match completed, current match length The predecessor state is the matching position corresponding to the anchor point. .

[0059] Simultaneously, record the predecessor parameter information and anchor point identification information corresponding to this seed state:

[0060]

[0061] During the seed state initialization phase, if multiple different initial combinations can generate the same initial state, they are merged according to the optimality principle of dynamic programming, and any one of them is retained as the predecessor record of the initial state.

[0062] In step S304, after initializing the seed state corresponding to the current anchor point, the corresponding dynamic programming dictionary dp only contains the initial reachable states under that anchor point. The matching path expansion in this stage is performed only within the set of reachable states corresponding to that anchor point, and uses that anchor point as the starting reference point for the matching path. The algorithm uses all seed states generated by the anchor point as the initial reachable state set and follows the baseline sequence. index Increasing direction (from) (Start) Expand the matching path layer by layer.

[0063] During the matching path expansion process, the baseline sequence is used. The index increment serves as the expansion order control condition. In any expansion layer, state transition operations are only performed on reachable states with the same base index and the current expansion layer index. Each state transition consumes one element of the base sequence A, thereby ensuring the continuity of the matching path in the dimension of the base sequence.

[0064] With reference sequence The indices are incremented sequentially, and the current index is traversed. The dictionary contains all reachable states, and the matching paths are expanded according to the rules to generate new reachable states. Let the current reachable state to be expanded be... Its state value is This indicates that consecutive matches have been successfully completed. A base element. Given the current state, iterate through the lengths of all valid combinations. , Ensure that the requirements are met. and and audio / video slice index constraints .

[0065] Under the condition that the above conditions are met, calculate the cooperative combination and And verify the error constraints If the error constraint is satisfied, a new reachable state is generated. And calculate the new matching length. Then, a dynamic programming optimality update strategy is executed; if Not yet In the middle, or Greater than Recorded in Match length (i.e.) If the status information is updated, then the status information will be updated: Simultaneously update the predecessor parameter dictionary and anchor point identifier dictionary.

[0066]

[0067]

[0068] Through the aforementioned state transition and optimality update process, a continuous matching path starting from the anchor point is gradually constructed until no new reachable state can be generated or the preset termination condition is reached.

[0069] In step S305, after completing the 3D dynamic programming matching process for each anchor point, the optimal termination state and cumulative matching length can be obtained for each anchor point. Based on this, the optimal termination states obtained for all anchor points are compared uniformly, and the termination state with the largest cumulative matching length is selected as the globally optimal termination state. Subsequently, using the globally optimal termination state as the backtracking starting point, and based on the predecessor state information recorded during the 3D dynamic programming process, a backtracking operation is performed on its corresponding matching path, progressively restoring a continuous sequence of optimal matching states. The backtracking process follows the baseline sequence. The index is decremented until the starting state of the matching path is reached, thus completely determining the globally optimal matching path in the baseline sequence. and video slice sequences Audio slice sequence The correspondence in the text.

[0070] After obtaining the continuous matching state sequence corresponding to the globally optimal matching path, the path is continuously expanded left and right to determine the final matching segment boundary. This left and right continuous expansion is performed only on the globally optimal matching path, without introducing new matching paths or recalculating dynamic programming. The expansion process uses the start and end states of the optimal matching path as the expansion benchmark. If the cumulative matching length of the globally optimal matching path... If the match is found to be perfect, then perform a single-step expansion on the left and right sides of the best matching segment; otherwise, it is directly determined to be a mismatch and no expansion is needed.

[0071] Left-side single-step expansion: along the baseline sequence The index decrement direction attempts to expand by one cell, using the original error constraint. The algorithm determines whether adjacent states satisfy the cooperative combination calculation and error constraint conditions. If they do, the state is included in the matching segment; otherwise, left-side expansion is stopped.

[0072] Right-side single-step expansion: along the baseline sequence The index increment direction is used to expand by one cell. The error threshold for this single-step expansion is appropriately relaxed, such as... This is done to tolerate slight deviations and increase the continuity of the matching segment. If the constraint is satisfied, the state is included in the matching segment; otherwise, right-side expansion stops.

[0073] After completing the single-step expansion, continuous expansion can continue: the left-side expansion follows the decreasing direction of the baseline sequence, with an error threshold of [missing value]. The process proceeds by sequentially checking whether adjacent states satisfy the matching conditions until the constraints are no longer met. The right-hand expansion follows the increasing direction of the baseline sequence, restoring the error threshold to its original value. The process proceeds by sequentially determining whether adjacent states meet the matching conditions, until the constraints are no longer met.

[0074] Through the above continuous left and right expansion process, a unique, continuous matching segment interval that covers the optimal matching path is finally obtained. At the same time, the error threshold is relaxed in the first step of right expansion to improve the robustness and effective length of the matching segment.

[0075] After completing the continuous left and right expansion of the globally optimal matching path, the final matching segment is quantitatively scored, and the final recognition conclusion is output based on the scoring results.

[0076] The comprehensive score is calculated based on the multi-dimensional matching features of the matching segments. The scoring model incorporates at least the following parameters: the cumulative matching length of the matching segment, the matching length recognition threshold (as a benchmark or constraint), the matching rate of the ciphertext fingerprint within the matching segment, the matching rate of the video fingerprint within the matching segment, and the matching rate of the audio fingerprint within the matching segment. The calculated comprehensive score is compared with a preset recognition threshold for determination. If the score reaches or exceeds the recognition threshold, the current ciphertext fingerprint is determined to be a successful match with the corresponding plaintext fingerprint combination. The video identifier (VID), video encoding parameters (itag), audio encoding parameters (itag), and the start and end indices of the matching segment in their respective sequences associated with the plaintext fingerprint combination are output, and the results are recorded in a text file or table file. After a successful ciphertext fingerprint match, the traversal processing of subsequent plaintext fingerprint combinations is terminated to improve the overall recognition efficiency of the system. If the score does not reach the recognition threshold, it is determined to be a mismatch, and the subsequent processing flow (such as traversing the next plaintext fingerprint combination) continues.

[0077] This application provides a dynamic programming-based DASH video recognition method for the QUIC protocol. By constructing a plaintext fingerprint database covering different resolutions and encoding formats, and combining it with a corrected fingerprint extracted from the ciphertext transmitted via the QUIC protocol, a three-dimensional dynamic programming-based DASH video recognition method is proposed. Compared with existing technologies, it has the following advantages: High feature stability and robustness: This application directly uses the features of real audio and video slices in the plaintext fingerprint database to match the QUIC transmission modified fingerprint, without relying on statistical features that are susceptible to interference under network conditions, nor on specific client implementations, thus ensuring that the same video can be stably identified under different network environments and client configurations.

[0078] Explainability and decision transparency: Through a clear dynamic programming matching process, optimal matching path backtracking and matching segment expansion mechanism, the identification results can be traced back to the specific audio and video slice combination, which facilitates system optimization, problem diagnosis and result verification.

[0079] Controllable matching accuracy: Through collaborative combination calculation, optimality update and matching segment left and right continuous expansion strategy, the matching error threshold and continuous length constraint can be adjusted according to the needs, thereby controlling the matching accuracy of ciphertext fingerprint and plaintext fingerprint, effectively dealing with audio and video slice length differences, multiplexing interleaving and index misalignment.

[0080] Highly scalable: The matching core parameters support dynamic configuration, making it suitable for scenarios such as video content recognition and network transmission data consistency verification with different resolutions and encoding formats, and has good adaptability.

[0081] The method is feasible for deployment (suitable for small-scale databases): It does not rely on deep learning models, requires no large amount of labeled training data, and reduces the space overhead of matching a single ciphertext fingerprint with a single set of plaintext fingerprints by storing reachable states and anchor step size control through a sparse dictionary. This solution can be feasiblely deployed in scenarios where the fingerprint database size is controllable.

[0082] In summary, this application solves the problems of feature drift and insufficient generalization ability in the prior art by dynamically programming the matching of plaintext fingerprints and modified transmission fingerprints, while ensuring the interpretability, stability and engineering practicality of the method, and realizing reliable identification of QUIC protocol encrypted DASH videos.

[0083] Based on the same inventive concept, this application also provides a dynamic programming-based QUIC protocol DASH video recognition device, see the appendix to the specification. Figure 6 The device includes: Module 601 is used to build a plaintext fingerprint library covering the target video under different resolutions and encoding formats; The correction module 602 is used to filter QUIC traffic that conforms to the video transmission domain name rules of the target video platform, and segment it to obtain a sequence of audio and video segments. It also extracts ciphertext features from the sequence of audio and video segments, and forms a transmission fingerprint after correction processing, which serves as a reference sequence. The matching module 603 is used to quickly filter, perform three-dimensional dynamic programming matching, expand the matching segment, and quantize the video slice sequence and audio slice sequence in the plaintext fingerprint database on the reference sequence, and output the recognition result.

[0084] Since the principle of the device in this application embodiment for solving the problem is similar to the above-mentioned dynamic programming-based QUIC protocol DASH video recognition method in this application embodiment, the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0085] Based on the same concept of the present invention, the specification is attached. Figure 7 As shown in the figure, an embodiment of this application provides the structure of an electronic device 700, which includes: at least one processor 701, at least one network interface 704 or other user interface 703, a memory 705, and at least one communication bus 702. The communication bus 702 is used to realize the connection and communication between these components. The electronic device 700 may optionally include a user interface 703, including a display (e.g., touch screen, LCD, CRT, holographic imaging, or projector, etc.), a keyboard, or a clicking device (e.g., mouse, trackball, touchpad, or touch screen, etc.).

[0086] Memory 705 may include read-only memory and random access memory, and provides instructions and data to processor 701. A portion of memory 705 may also include non-volatile random access memory (NVRAM).

[0087] In some implementations, memory 705 stores elements that can protect modules or data structures, or subsets thereof, or extended sets thereof: The 7051 operating system contains various system programs used to implement various basic business functions and handle hardware-based tasks. Application module 7052 contains various applications, such as desktop (launcher), media player (MediaPlayer), browser (Browser), etc., to implement various application services.

[0088] In this embodiment of the application, by calling the program or instructions stored in the memory 705, the processor 701 is used to execute steps such as in a dynamic programming-based QUIC protocol DASH video recognition method, which can stably, accurately and efficiently identify the target DASH video from encrypted, multiplexed, and audio-video mixed transmission traffic.

[0089] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs steps such as those in the dynamic programming-based QUIC protocol DASH video recognition method.

[0090] Specifically, the storage medium can be a general-purpose storage medium, such as a removable disk or hard disk. When the computer program on the storage medium is run, it can execute the above-mentioned dynamic programming-based QUIC protocol DASH video recognition method.

[0091] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and there may be other division methods in actual implementation. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interface; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0092] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0093] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0094] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0095] Finally, it should be noted that the above embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A QUIC protocol DASH video recognition method based on dynamic programming, characterized in that, The method includes the following steps: Construct a plaintext fingerprint database covering target videos at different resolutions and encoding formats; QUIC traffic that conforms to the video transmission domain name rules of the target video platform is filtered out and segmented into audio and video segment combination sequences. Ciphertext features are extracted from the audio and video segment combination sequences, and after correction processing, a transmission fingerprint is formed as a reference sequence. The system performs rapid filtering, three-dimensional dynamic programming matching, matching segment expansion, and quantitative scoring on the baseline sequence and video and audio slice sequences in the plaintext fingerprint database, and outputs the recognition results.

2. The QUIC protocol DASH video recognition method based on dynamic programming according to claim 1, characterized in that, The construction of a plaintext fingerprint database covering target videos at different resolutions and encoding formats includes the following steps: Using the target video VID as input, obtain four types of audio and video resources with different resolutions and encoding formats: MP4 video, MP4 audio, WebM video, and WebM audio. Based on the native slicing strategy of the video platform, the slice size sequence of various audio and video is extracted to form a basic fingerprint; After preprocessing the slice-sized sequence, multi-dimensional statistical features of the sequence are calculated to form an extended fingerprint; the statistical features include the number of sequences, extreme values, mean, variance, quartiles, and mode; The basic fingerprint is associated with the extended fingerprint and bound to metadata including VID and itag, and stored in the plaintext fingerprint database.

3. The QUIC protocol DASH video recognition method based on dynamic programming according to claim 2, characterized in that, The process of filtering QUIC traffic that conforms to the video transmission domain name rules of the target video platform, segmenting it into a sequence of audio and video segments, extracting ciphertext features from the sequence of audio and video segments, and forming a transmission fingerprint after correction processing includes the following steps: Based on the servername information in the TLS extension field during the QUIC handshake phase, the QUIC traffic used for video transmission by the target video platform is filtered out. For the filtered QUIC traffic, the continuously transmitted data is divided into a sequence of audio and video segments corresponding to a single request, using the client-initiated request as the dividing boundary. Ciphertext features are extracted from the audio and video segment combination sequence; the ciphertext features include a ciphertext length feature sequence and a data packet quantity statistical feature; The extracted ciphertext features were modified using a regression analysis model to form a transmission fingerprint, which served as a baseline sequence.

4. The QUIC protocol DASH video recognition method based on dynamic programming according to claim 3, characterized in that, Quick filtering includes the following steps: The audio and video fingerprints in the plaintext fingerprint database are grouped by VID, and the video fingerprint and audio fingerprint combination under each VID is traversed and a preliminary comparison is made with the baseline sequence. For each VID-based combined fingerprint, the difference between the baseline sequence and the plaintext fingerprint extended features is calculated in each dimension. If the difference exceeds a preset threshold, a mismatch is determined and the process is skipped. If the difference meets the preset threshold, subsequent three-dimensional dynamic programming matching is triggered.

5. The QUIC protocol DASH video recognition method based on dynamic programming according to claim 4, characterized in that, When performing 3D dynamic programming matching: Using a reference sequence Sequence to be matched and the sequence to be matched A baseline, two-to-match, three-sequence system; wherein, the sequences to be matched are... The sequence of bytes in a plaintext video slice is the sequence to be matched. Given a sequence of bytes for a plaintext audio slice, and , The number of video slices. This represents the number of audio slices. Set matching constraints, including a byte error threshold to constrain the maximum allowable deviation between the audio and video slice combination and the baseline sequence element; as well as the range of the number of video slice combinations, the range of the number of audio slice combinations, audio and video slice index constraints, and the effective continuous matching length threshold. An anchor point mechanism based on step size sampling is adopted; wherein, the reference sequence A is selected at equal intervals with a fixed step size, and three-dimensional dynamic programming matching is performed with each anchor point as an independent starting position; A sparse three-dimensional state storage is adopted; where the state triple state=(i,j,k) is the key, i is the current index of the baseline sequence A, j is the current index of the sequence to be matched B, and k is the current index of the sequence to be matched C; and dp[(i,j,k)]=(L,prev_state) is the value, where L is the length of continuous matching and prev_state is the predecessor state that represents the current state (i,j,k).

6. The QUIC protocol DASH video recognition method based on dynamic programming according to claim 5, characterized in that, Three-dimensional dynamic programming matching includes the following steps: Starting from the anchor point as the reference sequence matching starting point, the legal indices of the sequence to be matched B and the sequence to be matched C are traversed according to the audio and video slice index constraints. Within the range of video slice combination and audio slice combination, the length of the legal combination is enumerated. The error between the number of combination bytes and the elements of the reference sequence is calculated. If the byte error threshold is met, a seed state is generated and recorded in the sparse three-dimensional state space. The matching path is expanded layer by layer according to the index increment direction of the baseline sequence A. For each current state, legal slice combinations are enumerated under the range of combination quantity and index constraints to satisfy the byte error constraint, generate a new state, update the sparse three-dimensional state space according to the optimal matching principle, and save the predecessor state information. Iterate through the matching results corresponding to all anchor points, select the state with the longest continuous matching length as the global optimal termination state, and backtrack based on the predecessor state to obtain the complete matching path.

7. The QUIC protocol DASH video recognition method based on dynamic programming according to claim 6, characterized in that, Matching segment expansion and quantitative scoring include the following steps: The global optimal path is expanded to the left by the byte error threshold, and to the right by first widening it by twice the byte error threshold, and then continuously expanded by restoring the byte error threshold to determine the final matching segment interval. A comprehensive score is calculated by combining the cumulative matching length of the matching segment, the matching rate of the encrypted fingerprint within the matching segment, the matching rate of the video fingerprint within the matching segment, and the matching rate of the audio fingerprint within the matching segment; if the comprehensive score reaches the recognition threshold, the match is considered successful.

8. A QUIC protocol DASH video recognition device based on dynamic programming, characterized in that, The device includes: The building module is used to construct a plaintext fingerprint library covering target videos at different resolutions and encoding formats; The correction module is used to filter QUIC traffic that conforms to the video transmission domain name rules of the target video platform, and segment it into a sequence of audio and video segments. It also extracts ciphertext features from the audio and video segment combination sequence, and forms a transmission fingerprint after correction processing, which serves as a reference sequence. The matching module is used to quickly filter, perform three-dimensional dynamic programming matching, expand the matching segment, and quantize the video and audio slice sequences in the plaintext fingerprint database against the baseline sequence, and output the recognition results.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of the dynamic programming-based QUIC protocol DASH video recognition method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the dynamic programming-based QUIC protocol DASH video recognition method as described in any one of claims 1 to 7.

Images