Characterizing User Platforms for Video Streaming in Broadband Networks

TL;DR

This paper presents a real-time network traffic analysis method to identify user device types and software agents for video streams, aiding ISPs in troubleshooting and capacity planning despite encryption challenges.

Contribution

The authors develop a novel classification pipeline analyzing handshake attributes to accurately identify user platforms across major video providers, with over 96% accuracy.

Findings

High accuracy in user platform identification.

Insights into platform-specific bandwidth and usage patterns.

Deployment in a large campus network demonstrates practical applicability.

Abstract

Internet Service Providers (ISPs) bear the brunt of being the first port of call for poor video streaming experience. ISPs can benefit from knowing the user's device type (e.g., Android, iOS) and software agent (e.g., native app, Chrome) to troubleshoot platform-specific issues, plan capacity and create custom bundles. Unfortunately, encryption and NAT have limited ISPs' visibility into user platforms across video streaming providers. We develop a methodology to identify user platforms for video streams from four popular providers, namely YouTube, Netflix, Disney, and Amazon, by analyzing network traffic in real-time. First, we study the anatomy of the connection establishment process to show how TCP/QUIC and TLS handshakes vary across user platforms. We then develop a classification pipeline that uses 62 attributes extracted from the handshake messages to determine the user device and software agent of video flows with over 96% accuracy. Our method is evaluated and deployed in a large campus network (mimicking a residential broadband network) serving users including dormitory residents. Analysis of 100+ million video streams over a four-month period reveals insights into the mix of user platforms across the video providers, variations in bandwidth consumption across operating systems and browsers, and differences in peak hours of usage.