beauty and the burst - usenix | the advanced computing ... · pulp fiction die hard 12 monkeys the...
TRANSCRIPT
![Page 1: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/1.jpg)
1
Beauty and the Burst Remote Identification of Encrypted
Video Streams
Roei Schuster
Cornell Tech, Tel Aviv University
Vitaly Shmatikov
Cornell Tech
Eran Tromer
Columbia University, Tel Aviv University
![Page 2: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/2.jpg)
2
Video traffic is interesting
![Page 3: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/3.jpg)
3
Video traffic is encrypted
![Page 4: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/4.jpg)
4
What can still be learned?
Video traffic is encrypted
![Page 5: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/5.jpg)
5
victim
streaming service
Traffic analysis for video identification
![Page 6: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/6.jpg)
6
victim
streaming service
Traffic analysis for video identification
![Page 7: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/7.jpg)
7
victim
Metadata! packet times, sizes, …
streaming service
Traffic analysis for video identification
![Page 8: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/8.jpg)
8
Victim is watching
“Beauty and the Beast”!
victim
Metadata! packet times, sizes, …
streaming service
Traffic analysis for video identification
![Page 9: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/9.jpg)
9
Initial buffering, then “on”/“off” bursts pa
cke
t siz
e (
byte
s)
time (seconds)
![Page 10: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/10.jpg)
10
Initial buffering, then “on”/“off” bursts pa
cke
t siz
e (
byte
s)
time (seconds)
![Page 11: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/11.jpg)
11
[RLLTBD ’11], [ARNL ’12], [MFWS ’13], …
Initial buffering, then “on”/“off” bursts pa
cke
t siz
e (
byte
s)
time (seconds)
![Page 12: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/12.jpg)
12
[RLLTBD ’11], [ARNL ’12], [MFWS ’13], …
Where do bursts come from?
Initial buffering, then “on”/“off” bursts pa
cke
t siz
e (
byte
s)
time (seconds)
![Page 13: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/13.jpg)
13
streaming service
Video representation on server
![Page 14: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/14.jpg)
14
streaming service
Video representation on server
![Page 15: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/15.jpg)
15
streaming service
Pulp Fiction
Die Hard
12 Monkeys
The Fifth Element
Die Hard II
Armageddon
Video representation on server
![Page 16: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/16.jpg)
16
Pulp Fiction
Die Hard
12 Monkeys
The Fifth Element
Die Hard II
Armageddon
MPEG-DASH standard:
widely adopted by Netflix, YouTube, others
Video representation on server
![Page 17: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/17.jpg)
17
Pulp Fiction
Die Hard
12 Monkeys
The Fifth Element
Die Hard II
Armageddon
segment2.m4s
segment3.m4s
segment4.m4s
segment1.m4s
video stored in segment-files
MPEG-DASH standard:
widely adopted by Netflix, YouTube, others
Video representation on server
![Page 18: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/18.jpg)
18
Pulp Fiction
Die Hard
12 Monkeys
The Fifth Element
Die Hard II
Armageddon
segment2.m4s
segment3.m4s
segment4.m4s
segment1.m4s
video stored in segment-files
segment = a few seconds
of playback
MPEG-DASH standard:
widely adopted by Netflix, YouTube, others
0-5sec
5-10sec
10-15sec
15-20sec
Video representation on server
![Page 19: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/19.jpg)
19
server client
buffer below threshold?
yes
request next
segment
no
segment2.m4s
segment3.m4s
segment4.m4s
segment1.m4s
server
segment5.m4s
segment6.m4s
DASH client-server interaction (simplified)
![Page 20: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/20.jpg)
20
server client
buffer below threshold?
yes
request next
segment
no
segment2.m4s
segment3.m4s
segment4.m4s
segment1.m4s
server
segment5.m4s
segment6.m4s
segment fetched every few seconds
DASH client-server interaction (simplified)
![Page 21: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/21.jpg)
21
server client
buffer below threshold?
yes
request next
segment
no
segment2.m4s
segment3.m4s
segment4.m4s
segment1.m4s
server
segment5.m4s
segment6.m4s
fetching causes a traffic burst
segment fetched every few seconds
DASH client-server interaction (simplified)
![Page 22: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/22.jpg)
22
Different video seconds require different amount of bytes to encode
Bitra
te (
byte
s)
Time (seconds)
Iguana vs. Snakes VBR
Variable bit rate encoding
![Page 23: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/23.jpg)
23
Phases of Iguana vs Snakes in Bitrate
scenery, movement,
tension rising
Bitra
te (
bits p
er
se
co
nd
)
Time (seconds)
![Page 24: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/24.jpg)
24
Phases of Iguana vs Snakes in Bitrate
tension peaking, iguana is still
Bitra
te (
bits p
er
se
co
nd
)
Time (seconds)
![Page 25: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/25.jpg)
25
Phases of Iguana vs Snakes in Bitrate
chase
Bitra
te (
bits p
er
se
co
nd
)
Time (seconds)
![Page 26: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/26.jpg)
26
Phases of Iguana vs Snakes in Bitrate
chase
iguana almost captured
Bitra
te (
bits p
er
se
co
nd
)
Time (seconds)
![Page 27: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/27.jpg)
27
Phases of Iguana vs Snakes in Bitrate
iguana safe, resting
Bitra
te (
bits p
er
se
co
nd
)
Time (seconds)
![Page 28: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/28.jpg)
28
Different video seconds require different amount of bytes to encode
Bitra
te (
byte
s)
Time (seconds)
Iguana vs. Snakes VBR
Variable bit rate encoding
![Page 29: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/29.jpg)
29
Pulp Fiction
Die Hard
12 Monkeys
The Fifth Element
Die Hard II
Armageddon Segment2.m4s
Segment3.m4s
Segment4.m4s
Segment1.m4s
Segment5.m4s
0-5sec
5-10sec
10-15sec
15-20sec
20-25sec
Variable bit rate variable segment size
![Page 30: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/30.jpg)
30
Variable segment size variable burst size
buffering On/off bursts
bu
rst siz
e (
byte
s)
Time (seconds)
![Page 31: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/31.jpg)
31
Variable segment size variable burst size
buffering On/off bursts
bu
rst siz
e (
byte
s)
Time (seconds)
![Page 32: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/32.jpg)
32
segments
VBR pattern
stream time
burst sizes
content
MPEG-DASH leak
![Page 33: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/33.jpg)
33
burst sizes
stream time
Does the pattern of burst (segment) sizes uniquely
characterize a title?
Can we learn a title’s identifying
pattern?
From a leak to a fingerprint
![Page 34: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/34.jpg)
34
burst sizes
stream time
Does the pattern of burst (segment) sizes uniquely
characterize a title?
Can we learn a title’s identifying
pattern?
Diversity: empirically measure pairwise distances for 3500 downloaded and segmented YouTube titles
From a leak to a fingerprint
![Page 35: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/35.jpg)
35
burst sizes
stream time
Does the pattern of burst (segment) sizes uniquely
characterize a title?
Consistency: empirically evaluate attacker’s measurement error bound
Can we learn a title’s identifying
pattern?
Diversity: empirically measure pairwise distances for 3500 downloaded and segmented YouTube titles
From a leak to a fingerprint
![Page 36: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/36.jpg)
36
burst sizes
stream time
Does the pattern of burst (segment) sizes uniquely
characterize a title?
Consistency: empirically evaluate attacker’s measurement error bound
Can we learn a title’s identifying
pattern?
~20% of YouTube titles have fingerprints
Diversity: empirically measure pairwise distances for 3500 downloaded and segmented YouTube titles
From a leak to a fingerprint
![Page 37: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/37.jpg)
37
victim network
Pulp Fiction
Die Hard
Armageddon attacker network
12 Monkeys
Attack overview
![Page 38: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/38.jpg)
38
victim network
Pulp Fiction
Die Hard
Armageddon attacker network
12 Monkeys
Attack overview
![Page 39: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/39.jpg)
39
metadata
victim network
Pulp Fiction
Die Hard
Armageddon attacker network
12 Monkeys
Attack overview
![Page 40: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/40.jpg)
40
detectors
metadata
train
ing
victim network
Pulp Fiction
Die Hard
Armageddon attacker network
12 Monkeys
Attack overview
![Page 41: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/41.jpg)
41
detectors
metadata
train
ing
victim network
Pulp Fiction
Die Hard
Armageddon Armageddon attacker network
12 Monkeys
Attack overview
![Page 42: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/42.jpg)
42
detectors
metadata
train
ing
victim network
Pulp Fiction
Die Hard
Armageddon Armageddon attacker network
12 Monkeys
Attack overview
![Page 43: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/43.jpg)
43
detectors
metadata
train
ing
victim network
Pulp Fiction
Die Hard
Armageddon Armageddon attacker network
Victim is watching
“Armageddon”!
12 Monkeys
Attack overview
![Page 44: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/44.jpg)
44
detectors
train
ing
victim network
Pulp Fiction
Die Hard
12 Monkeys
Armageddon Armageddon attacker network
vantage point?
Attack details
metadata
![Page 45: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/45.jpg)
45
bursts
Wi-Fi access points, proxies, routers, enterprise or national network censors, ISPs
on-path vantage
point
Scenario I: on-path attack
![Page 46: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/46.jpg)
46
detectors
train
ing
victim network
Pulp Fiction
Die Hard
12 Monkeys
Armageddon Armageddon attacker network
machine learning
Attack details
metadata
![Page 47: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/47.jpg)
47
• Very good at learning high-level concepts that are hard to
express formally (e.g., “traffic traces are similar”)
• Existing NN architectures very accurate on classification
and detection problems
Deep neural networks
![Page 48: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/48.jpg)
48
• Robust: can operate on noisy and coarse
measurements
• Agnostic to protocol-specific attributes (e.g.,
QUIC vs. TLS)
• Can learn features other than burst patterns,
e.g., arrival patterns of individual packets
• Can use multiple session representations,
train on all at once
Advantages of neural networks
![Page 49: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/49.jpg)
49
Each feature is a time-series, sampled at 0.25-second intervals (example: bytes per second)
0 0.25 0.5 0.75 1
time (seconds)
packe
t siz
e
1500
300
0.25 ⋅
15000
2 ⋅ 1500300……
Features considered: downstream/upstream/total values of bytes per
second, packet per second, average packet length, and burst sizes
Features
![Page 50: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/50.jpg)
50
detectors
train
ing
victim network
Pulp Fiction
Die Hard
12 Monkeys
Armageddon Armageddon attacker network
neural net
Attack
On-path attacker
metadata
![Page 51: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/51.jpg)
51
10 titles 100 1-minute sessions
18 titles 100 3-minute sessions + 3500 sessions of different other titles
10 titles 100 1.5-minute sessions
100 titles 100 1-minute sessions
Datasets and identification experiments
![Page 52: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/52.jpg)
52
10 titles 100 1-minute sessions
18 titles 100 3-minute sessions + 3500 sessions of different other titles
10 titles 100 1.5-minute sessions
100 classes
100 titles 100 1-minute sessions
Datasets and identification experiments
![Page 53: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/53.jpg)
53
10 titles 100 1-minute sessions
18 titles 100 3-minute sessions + 3500 sessions of different other titles
10 titles 100 1.5-minute sessions
100 classes
18+1=19 classes
open-world identification
100 titles 100 1-minute sessions
Datasets and identification experiments
![Page 54: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/54.jpg)
54
10 titles 100 1-minute sessions
18 titles 100 3-minute sessions + 3500 sessions of different other titles
10 titles 100 1.5-minute sessions
100 classes
18+1=19 classes
10 classes
10 classes
open-world identification
100 titles 100 1-minute sessions
Datasets and identification experiments
![Page 55: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/55.jpg)
55
10 titles 100 1-minute sessions
18 titles 100 3-minute sessions + 3500 sessions of different other titles
10 titles 100 1.5-minute sessions
100 classes
18+1=19 classes
10 classes
10 classes
98.5% accuracy
99.5% accuracy
98.6% accuracy
92.5% accuracy
open-world identification
100 titles 100 1-minute sessions
Datasets and identification experiments
![Page 56: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/56.jpg)
56
Netflix (feature: total burst size)
YouTube (feature: total burst size)
Predicted label Predicted label
“unknown” class, 3500 samples
Empirical results: confusion matrices
![Page 57: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/57.jpg)
57
Netflix (feature: total burst size)
YouTube (feature: total burst size)
Predicted label Predicted label
“unknown” class, 3500 samples Exactly 2 false positives
No recurrent confusions (despite many same-series titles)
Empirical results: confusion matrices
![Page 58: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/58.jpg)
58
0 false positives with 0.988 recall
0.0005 false positive rate with 0.93 recall
Netflix (feature: total burst size)
YouTube (feature: total burst size)
Tuning for precision
![Page 59: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/59.jpg)
59
detectors
train
ing
victim network
Pulp Fiction
Die Hard
12 Monkeys
Armageddon Armageddon attacker network
vantage point?
Attack details
train
ing
neural net
metadata
![Page 60: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/60.jpg)
60
Wi-Fi access points, proxies, routers, enterprise or national network censors, ISPs
bursts
victim network
on-path vantage
point
Off-path attackers
![Page 61: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/61.jpg)
61
bursts
victim network Off-path attackers
![Page 62: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/62.jpg)
62
A visited webpage? A smartphone app?
bursts
victim network Off-path attackers
![Page 63: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/63.jpg)
63
A visited webpage? A smartphone app?
bursts
victim network Off-path attackers
Example: checking Facebook feed while streaming “Armageddon”
![Page 64: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/64.jpg)
64
A visited webpage? A smartphone app?
bursts
victim network Off-path attackers
Example: checking Facebook feed while streaming “Armageddon”
![Page 65: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/65.jpg)
65
A visited webpage? A smartphone app?
bursts
victim network Off-path attackers
Example: checking Facebook feed while streaming “Armageddon”
![Page 66: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/66.jpg)
66
A visited webpage? A smartphone app?
bursts
victim network
Web ad
Off-path attackers
Example: checking Facebook feed while streaming “Armageddon”
![Page 67: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/67.jpg)
67
A visited webpage? A smartphone app?
bursts
victim network
Web ad
Off-path attackers
Example: checking Facebook feed while streaming “Armageddon”
![Page 68: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/68.jpg)
68
A visited webpage? A smartphone app?
bursts
victim network
Web ad
Three-fold confinement: different device, browser process, sandboxed iframe
Off-path attackers
Example: checking Facebook feed while streaming “Armageddon”
![Page 69: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/69.jpg)
69
Browser
neighbor
viewer Cross-device attack
![Page 70: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/70.jpg)
70
JavaScript attacker client
Browser
attacker Web site
neighbor
viewer Cross-device attack
![Page 71: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/71.jpg)
71
JavaScript attacker client
Browser
attacker Web site
neighbor
viewer Cross-device attack
messages
![Page 72: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/72.jpg)
72
JavaScript attacker client
Congestion
Browser
attacker Web site
neighbor
viewer Cross-device attack
messages
![Page 73: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/73.jpg)
73
JavaScript attacker client
Congestion
Browser
attacker Web site
bursts
neighbor
viewer Cross-device attack
messages
![Page 74: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/74.jpg)
74
JavaScript attacker client
Congestion
Browser
attacker Web site
bursts
delays
neighbor
viewer Cross-device attack
messages
![Page 75: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/75.jpg)
75
JavaScript attacker client
Noisy, coarse estimate of actual traffic bursts
Congestion
Browser
attacker Web site
bursts
delays
neighbor
viewer Cross-device attack
messages
![Page 76: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/76.jpg)
76
traffic burst sizes (scaled down) Message
delays
Delay-bursts dela
y (
mill
iseconds)
time (seconds)
![Page 77: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/77.jpg)
77
For each traffic burst, compute aggregate delay induced. Use resulting time-series as input to neural network
traffic burst sizes (scaled down) Message
delays
Delay-bursts dela
y (
mill
iseconds)
time (seconds)
![Page 78: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/78.jpg)
78
Delay-bursts vs. traffic bursts
delay-bursts time series: the delays induced by traffic bursts
![Page 79: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/79.jpg)
79
Accuracy: 0.965
false positive rate: 0.003, recall 0.933
1/10 cross-device attack: precision vs. recall
![Page 80: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/80.jpg)
80
JavaScript detector code
Browser
attacker Web site
Cross-device attack
neighbor
viewer
![Page 81: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/81.jpg)
81
attacker Web site
Cross-site attack
Streaming client
victim PC browser window
browser window
JavaScript detector code
![Page 82: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/82.jpg)
82
• Modern streaming traffic characteristics
– Title bitrate pattern unique when sampled at few-seconds granularity
– Fetching at segment granularity (= every few seconds)
• Maximizes “quality of experience”, server load, and network
bandwidth utilization
• However, information leakage is intrinsic…
Buffer below threshold?
yes
fetch next segment
no
Mitigating the DASH leak
![Page 83: Beauty and the Burst - USENIX | The Advanced Computing ... · Pulp Fiction Die Hard 12 Monkeys The Fifth Element Die Hard II Armageddon segment2.m4s segment3.m4s segment4.m4s segment1.m4s](https://reader030.vdocuments.net/reader030/viewer/2022040416/5f3828b4fde1260c7a57d25a/html5/thumbnails/83.jpg)
83
• Further information and the paper:
https://beautyburst.github.io/
Thank you!