###### Abstract  
Internet service providers allocate network resources for different network flows. Among them, video streaming requires substantial network bandwidth to provide a satisfactory user experience. The identification of video traffic is one of the tools that helps to manage and optimise network resources. However, available solutions usually focus on traffic traces from a single application and use black-box models for identification, which require labels for training. To address this issue, we proposed an unsupervised machine learning model to identify traffic generated by video applications from the three popular services, namely YouTube, Netflix, and Amazon Prime. Our methodology involves feature generation, filtering, and clustering. The clustering used the most significant features to group similar traffic patterns. We employed the following three algorithms that represent different clustering methodologies: partition-based, density-based, and probabilistic approaches. The clustering achieved precision between 0.78 and 0.93, while recall rates ranged from 0.68 to 0.84, depending on the experiment parameters, which is comparable with black-box learning models. The model presented is interpretable and scalable, which is useful for its practical application. v 2025 16 January 2025  
video traffic and the use of dynamically assigned port numbers by applications. Hence, researchers instead analyse the statistical characteristics of traffic flows, such as packet size, timing, or flow duration. The analysis can employ relatively simple statistical methods to summarise, describe, and infer properties, or can apply machine learning (ML). In the latter scenario, ML models are trained either on labelled datasets of known traffic types or group similar traffic patterns without prior labelling. ML often relies on black-box models, which lack information about the employed features which make traffic distinguishable. In our work, we strive to model explainability; therefore, we separate data processing from ML training using feature engineering followed by unsupervised learning. As ML models have become more complex and their decision-making processes have become opaque, feature engineering has started to play an increasing role, as it improves the performance of ML algorithms operating in different domains [1; 2; 3]. Contemporary video traffic can be distinguished from non-video traffic by its statistical characteristics. Namely, to save network bandwidth and optimise transmission, providers use Dynamic Adaptive Streaming over HTTP (DASH) specification to distribute their video. In DASH, a server stores video files split into segments, which are then requested on-demand by a client. These segments impact the video traffic, generating an ON/OFF pattern that occurs quite regularly when the network bandwidth is stable (see Figure 1). The characteristic pattern depends on the video segments-fetching algorithm implemented in a video player. The above patterns help to distinguish video traffic from other applications. However, previous works have focused mainly on YouTube and have omitted Netflix and Amazon's Prime Video, which have been equally popular in recent years [4]. Out of a variety of methods, unsupervised clustering allows us to automate the identification process as there is no need to manually label the training data. However, to improve the efficiency of clustering, it is necessary to pre-process the data. For this purpose, we used feature engineering, which involves the computation and filtering of several hundred features to find the most significant ones. The features should also enhance the interpretability of our model and help us to understand the model's behaviour. Apart from the features, a clustering algorithm also affects the traffic identification result. In order not to rely on just one solution that may have bias, we employed three algorithms, namely KMeans, Ordering points to identify the clustering structure (OPTICS), and AutoClass, representing different clustering approaches.