Inferring ADU Combinations from Encrypted QUIC Stream

Abstract

Video traffic has experienced rapid growth in the past and will continue to grow rapidly. It is an essential issue to monitor video streaming for both network management and network security. With the popularity of encrypted video, most of the analysis methods are based on the extraction of application data units (ADUs) from an encrypted stream. However, that QUIC streaming use multiplexing makes it impossible to extract ADU from encrypted QUIC streaming. In an effort to overcome this challenge, we proposed a method to extract application data unit combination (ADUC) from encrypted QUIC streaming instead. Taking YouTube video streaming as an example, several stream features are defined. These features are used to develop machine learning models for classifying the ADUC types in the encrypted YouTube QUIC video streaming. The feasibility and accuracy of the method are validated by the actual encrypted YouTube QUIC video streams. Our proposed method represents an initial step towards the analysis of encrypted QUIC streaming.