QoE Estimation in Encrypted Traffic Bogdan Iacob Technical - PowerPoint PPT Presentation

Chair of Network Architectures and Services Department of Informatics Technical University of Munich Streaming Video Detection and QoE Estimation in Encrypted Traffic Bogdan Iacob Technical University of Munich Department of Informatics Chair of Network Architectures and Services Garching bei München, 13. Oktober 2017

Outline 1. Introduction 2. Streaming Video Detection 3. QoE Estimation 4. Conclusions 5. Bibliography Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 2

Introduction What is Quality of Experience (QoE)?  A metric to define the overall level of customer satisfaction  Emerged from Quality of Service (QoS)  A key matter in the field of telecommunications  Expresses user satisfaction both objectively and subjectively  Based on 3 classes of influence factors: - Human Influence Factors - System Influence Factors - Context Influence Factors Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 3

Introduction Why is the detection of encrypted videos important for QoE?  Videos have a considerable impact on the user experience  Cisco estimates that by 2021, video streaming will reach 82% of all Internet traffic*  Over The Top (OTT) providers, like YouTube and Netflix, already switched to encrypted traffic  Current QoE measurements still rely on deep packet inspection (DPI) *Cisco Visual Networking Index: Forecast and Methodology, 2016-2021. June 6, 2017. Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 4

Streaming Video Detection DNS Lookup  Idea: identify video packets by knowing in advance the specific server IP addresses (research focuses on YouTube servers)  The video server IP list is built and constantly updated A video server’s IP is identified by searching for a specific string “r*.googlevideo.com” in  DNS responses or SSL/TLS handshake packets Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 5

Streaming Video Detection Fingerprinting YouTube Traffic  Idea: leverage the 2 streaming modes currently used by YouTube: 1. Apple HTTP Live Streaming (HLS) 2. MPEG Dynamic Adaptive Streaming over HTTP (DASH)  HLS has following characteristics:  Each streaming session starts with the transfer of an index file (“manifest”), which is located on a different server than the associated video files  The ClientHello messages of the SSL/TLS handshakes contain the string “manifest.googlevideo.com”  Right after the handshake, a large video block is sent. Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 6

Streaming Video Detection Fingerprinting YouTube Traffic  Idea: leverage the 2 streaming modes currently used by YouTube: 1. Apple HTTP Live Streaming (HLS) 2. MPEG Dynamic Adaptive Streaming over HTTP (DASH)  DASH has following characteristics:  Each streaming session starts with the transfer of an index file (“ initsegment ”)  Both the index file and its associated video files are located on the same server  Right after the handshake, a small 1.5KB segment is sent by the video server Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 7

Streaming Video Detection Fingerprinting Netflix Traffic  Netflix encodes the videos as variable bitrate (VBR) and streams them using DASH  The combination of VBR and DASH can produce unique fingerprints for each video  This pattern can be particularly observable for Netflix videos as they have a higher amplitude of the bitrate variation, compared to other streaming services Figure 1: Netflix video overhead due to HTTP headers and TLS Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 8

Streaming Video Detection Fingerprinting Netflix Traffic  Used Tools:  Adudump: to infer the size of application data units, using the TCP sequence and acknowledgement numbers.  OpenWPM: framework based on Firefox and Selenium, which visits sequentially all URLs offered as input. Figure 3: Cumulative probability of identifying a Figure 2: adudump trace. video before a specified amount of time has elapsed. Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 9

QoE Estimation Key Performance Indicators – Initial Delay  Time span between a user’s video request and the actual playback begin  Composed of 2 delays: - Network delay (time required to send request to server and receive first segments) - Initial buffering delay (time required to fill the initial buffer)  Impact on QoE: low Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 10

QoE Estimation Key Performance Indicators – Stalling  Occurs when the content consumption rate exceeds the average download rate  Severity of stalls is influenced by 2 factors: - Duration - Frequency  Impact on QoE: high Figure 4: Stalling vs. initial delay for YouTube QoE Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 11

QoE Estimation Key Performance Indicators – Average Representation Quality  Average quality of all streamed video segments  Overall media throughput, measured in bits per second  Relevant for video streams which use HTTP Adaptive Streaming  Impact on QoE: high Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 12

QoE Estimation Key Performance Indicators – Representation Quality Variation  Changes in the representation quality throughout a video session  Based on 2 components:  Frequency of quality changes  Amplitude of quality changes  Impact on QoE: high Figure 5: Frequency and time on highest layer changed simultaneously. Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 13

QoE Estimation Machine Learning  Idea : use machine learning to quantify the correlation between QoS and QoE  The process consists of 3 steps: Data collection – application-level data and network traffic are captured 1. Data processing – traffic features are derived for each video to form datasets 2. Model building – datasets are used to train the model 3.  A quality level (high, medium, low) is assigned to each video Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 14

QoE Estimation Machine Learning  Idea : use machine learning to quantify the correlation between QoS and QoE Figure 6: Approach for QoE classication based on network features. Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 15

Conclusions  QoE is an important metric used to define the level of customer satisfaction by mobile operators and internet service providers  Most of the Internet traffic is video traffic  The quality of video streaming has a high impact on the perceived QoE  The trend for OTT providers goes towards the use of encrypted traffic  Encrypted video traffic can be detected based on the streaming mechanism (DASH/HLS)  QoE can be estimated using Machine Learning by leveraging the QoS – QoE correlation Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 16

Bibliography  G. Dimopoulos, I. Leontiadis, P. Barlet-Ros, and K. Papagiannaki. Measuring video qoe from encrypted traffic. In Proceedings of the 2016 Internet Measurement Conference, pages 513-526, 2016.  I. Orsolic, D. Pevec, M. Suznjevic, and L. Skorin-Kapov. A machine learning approach to classifying youtube qoe based on encrypted network traffic. Multimedia Tools and Applications, pages 1-35, 2017.  W. Pan, G. Cheng, H. Wu, and Y. Tang. Towards qoe assessment of encrypted youtube adaptive video streaming in mobile networks. In 2016 IEEE/ACM 24th International Symposium on Quality of Service (IWQoS), pages 1-6, 2016.  A. Reed and M. Kranch. Identifying https-protected Netflix videos in real-time. In Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, pages 361-368, 2017.  T. Hossfeld, M. Seufert, C. Sieber, and T. Zinner. Assessing eect sizes of inuence factors towards a qoe model for http adaptive streaming. In 2014 Sixth International Workshop on Quality of Multimedia Experience (QoMEX), pages 111-116, 2014. Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 17

Questions ? Bogdan Iacob | Streaming Video Detection and QoE Estimation in Encrypted Traffic | 13.10.2017 18