Encrypted OTT Video Flow Classification via Shallow Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Deep Packet Inspection (DPI) methods are ineffective for classifying encrypted data traffic in ISP networks, as they require inspection of data payloads, and most traffic classification techniques are not suitable for encrypted traffic.
Innovation Solution
Implementing a method using shallow packet inspection (SPI) to classify Over The Top (OTT) video flows by leveraging their persistence and self-similarity, which does not require payload inspection, and utilizing existing network technology such as Cisco IOS NetFlow to generate and analyze flow data, combined with manifold learning diffusion maps and deep learning techniques for classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Deep Packet Inspection (DPI) is used for traffic classification, then classification accuracy for non-encrypted traffic is improved, but the method becomes ineffective for encrypted traffic
Solution Approach 1:
The patent extracts the classification function from payload inspection (DPI) to header-only inspection (SPI). By taking out the requirement to inspect encrypted payloads, the system maintains classification capability for encrypted traffic while preserving accuracy for non-encrypted traffic through behavioral analysis of flow characteristics
Solution Approach 2:
The patent introduces flow behavioral characteristics as an intermediary between the classification system and encrypted traffic. Instead of directly inspecting encrypted payloads, the system uses intermediate flow metrics (packet sizes, inter-arrival times, duration) that are visible in unencrypted headers to infer application type
2Adaptability or versatility
If Shallow Packet Inspection (SPI) is used for encrypted traffic classification, then adaptability to encrypted traffic is improved, but measurement precision for classification is reduced
Solution Approach 1:
The patent segments the classification process into multiple independent analysis dimensions: flow duration, packet size distribution, inter-arrival time patterns, and burst characteristics. By segmenting the analysis into multiple behavioral features, the system achieves high classification accuracy using only shallow inspection of encrypted traffic
Solution Approach 2:
The patent combines multiple flow behavioral characteristics (duration, packet sizes, inter-arrival times, burst patterns) into a composite classification approach. This composite analysis of multiple SPI-derived features compensates for the limited information available from shallow inspection, achieving high precision for encrypted traffic
3Measurement precision
If Deep Packet Inspection (DPI) is used for traffic classification, then classification accuracy is improved, but device complexity increases
Solution Approach 1:
The patent extracts the classification function from complex payload inspection to simpler header-based flow analysis. By removing the requirement to decrypt and inspect payloads, the system reduces device complexity while maintaining classification effectiveness through behavioral analysis
4Adaptability or versatility
If behavioral analysis methods are used for encrypted traffic classification, then adaptability to encrypted traffic is improved, but difficulty of detecting and measuring flow characteristics increases
Solution Approach 1:
The patent enables flow characteristics to self-reveal through natural packet transmission patterns. By monitoring inherent flow behaviors (packet sizes, timing, duration) that applications naturally exhibit during normal operation, the system detects and measures characteristics without requiring active probing or complex analysis mechanisms
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
In one embodiment, a method for video traffic flow behavioral classification is implemented on a computing device and includes: receiving coarse flow data from a network router, where the coarse flow data includes summary statistics for data flows on the router, classifying the summary statistics to detect video flows from among the data flows, requesting fine flow data from the network router for each of the detected video flows, where the fine flow data includes information on a per packet basis, receiving the fine flow data from the network router, and classifying each of the detected video flows per video service provider in accordance with the information.