Encrypted video traffic clustering demystified

Dvir, A., Marnerides, A. K. , Dubin, R., Golan, N. and Hajaj, C. (2020) Encrypted video traffic clustering demystified. Computers and Security, 96, 101917. (doi: 10.1016/j.cose.2020.101917)

Abstract

Cyber threat intelligence officers and forensics investigators often require the behavioural profiling of groups based on their online video viewing activity. It has been demonstrated that encrypted video traffic can be classified under the assumption of using a known subset of video titles based on temporal video viewing trends of particular groups. Nonetheless, composing such a subset is extremely challenging in real situations. Therefore, this work exhibits a novel profiling scheme for encrypted video traffic with no a priori assumption of a known subset of titles. It introduces a seminal synergy of Natural Language Processing (NLP) and Deep Encoder-based feature embedding algorithms with refined clustering schemes from off-the-shelf solutions, in order to group viewing profiles with unknown video streams. This study is the first to highlight the most computationally effective, accurate combinations of feature embedding and clustering using real datasets, thereby, paving the way to future forensics tools for automated behavioural profiling of malicious actors.

• Item Type: Articles
• Status: Published
• Refereed: Yes
• Glasgow Author(s) Enlighten ID: Marnerides, Dr Angelos

Creator Roles

Marnerides, A. K.: Investigation, Methodology, Validation, Writing – original draft

• Authors: Dvir, A., Marnerides, A. K., Dubin, R., Golan, N., and Hajaj, C.
• College/School: College of Science and Engineering > School of Computing Science
• Journal Name: Computers and Security
• Publisher: Elsevier
• ISSN: 0167-4048
• ISSN (Online): 1872-6208
• Published Online: 31 May 2020
• Copyright Holders: Copyright © 2020 Elsevier Ltd.
• First Published: First published in Computers and Security 96: 101917
• Publisher Policy: Reproduced in accordance with the publisher copyright policy