A
video streaming user platform identification process for
processing data packets of ISP level network traffic to automatically identify in real-time user platforms and content providers of video streams of the network traffic, the process being for execution at the ISP level by at least one processor of a
video streaming user platform identification apparatus of a
network service provider, the process including the steps of: receiving data packets of general network traffic of a plurality of network users of the
network service provider;
processing the received data packets to detect TCP /
QUIC and TLS
handshake packets of video streams of corresponding ones of the network users;
processing the detected TCP /
QUIC and TLS
handshake packets of video streams to generate, for each of the video streams, a corresponding plurality of values of respective predetermined attributes; for each of the video streams, processing the corresponding attributes values with a trained classifier to classify the video
stream into a corresponding one of a plurality of predetermined classes, each of the predetermined classes representing a corresponding combination of a corresponding content provider of the video
stream, and a corresponding user platform being used by a corresponding one of the network users to
stream the video stream from the corresponding content provider; and generating statistical data representing a statistical distribution of the classes of video streams being streamed via the
network service provider; wherein the user platform includes at least one of: (i) the user's
operating system; and (ii) the user's
software application being used to stream the video stream.