Traffic spills the beans: A robust video identification attack against YouTube

Authors:
raw_author_name: Xiyuan Zhang
raw_affiliation_string: Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China; School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 101408, China
raw_author_name: Gang Xiong
raw_affiliation_string: Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China; School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 101408, China
raw_author_name: Zhen Li
raw_affiliation_string: Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China; School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 101408, China
raw_author_name: Chen Yang
raw_affiliation_string: Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China; School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 101408, China
raw_author_name: Xinjie Lin
raw_affiliation_string: Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China; School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 101408, China
raw_author_name: Gaopeng Gou
raw_affiliation_string: Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China; School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 101408, China
raw_author_name: Binxing Fang
raw_affiliation_string: Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China; School of Computer Science and Technology, Harbin Institute of Technology (Shenzhen), ShenZhen, 518055, China

Abstract: Traffic-based video identification attack is a side-channel attack that allows an attacker to identify transmitted online videos from encrypted network traffic. Existing attacks face two types of challenges: 1) YouTube's improved streaming technology renders them invalid or impacted; 2) real-world diverse traffic makes them underperform. In this paper, we provide the first study of YouTube's technical improvements and reveal its three key features: i) the mechanism that replaces the MPD file, ii) variable combined segments, and iii) various buffering processes. Based on the above analysis, we propose a Robust and easily scalable Video Identification Attack against YouTube called RoVIA. RoVIA extracts video fingerprints from video file headers and reference sequences from video traffic. RoVIA uses the reference sequence to generate candidate sequences in the pre-built video fingerprint library and achieves video identification by measuring sequence similarity. Experimental results show that RoVIA achieves open-world accuracy of 0.967, 0.924, and 0.863 in open-world, fixed-quality, and poor network experiments. Furthermore, RoVIA's scalability allows the target classes to be adjusted by updating the fingerprint library without collecting new samples and retraining parameters. This study aims to demonstrate the vulnerabilities of YouTube streaming technology and the potential consequences of its malicious use. We also propose two YouTube-friendly countermeasures to help developers build effective defenses.