Classifying flows and buffer state for YouTube's HTTP adaptive streaming service in mobile networks

TL;DR

This paper introduces a passive, machine learning-based traffic profiling method to identify YouTube video streams and buffer states in mobile networks without DPI, even under encryption.

Contribution

It presents a novel IP-level traffic profiling approach using Random Forests to accurately classify HAS flows and buffer states without DPI or decrypting traffic.

Findings

High accuracy in flow and buffer state detection across varying link qualities

Method requires no deep packet inspection or decryption

Low complexity and compatible with encrypted traffic

Abstract

Accurate cross-layer information is very useful to optimize mobile networks for specific applications. However, providing application-layer information to lower protocol layers has become very difficult due to the wide adoption of end-to-end encryption and due to the absence of cross-layer signaling standards. As an alternative, this paper presents a traffic profiling solution to passively estimate parameters of HTTP Adaptive Streaming (HAS) applications at the lower layers. By observing IP packet arrivals, our machine learning system identifies video flows and detects the state of an HAS client's play-back buffer in real time. Our experiments with YouTube's mobile client show that Random Forests achieve very high accuracy even with a strong variation of link quality. Since this high performance is achieved at IP level with a small, generic feature set, our approach requires no Deep Packet Inspection (DPI), comes at low complexity, and does not interfere with end-to-end encryption. Traffic profiling is, thus, a powerful new tool for monitoring and managing even encrypted HAS traffic in mobile networks.