Real-time Application Identification of RTC Media Streams via Encrypted Traffic Analysis

The globalization of the economy and the increase in network bandwidth have contributed significantly to the development and popularity of real-time communication (RTC) social applications. RTC media streams, such as video meetings and calls, require more network resources and real-time performance than other services. In order to meet the requirements of RTC application providers to offer a higher level of service to their subscribers, Internet Service Providers (ISPs) need to identify the application to which the RTC media stream belongs. There are already some studies on traffic identification. However, the extant work is not yet able to distinguish the corresponding applications from the same type of media streams in real time. In addition, most of the work is not validated with actual data containing massive background traffic. Hence, we propose a real-time application identification method for meeting and calling RTC media streams in social networks. By analyzing the encrypted traffic, the method extracts features from the unit-time traffic aggregation without using payload and related information fields. The generated feature sequences are fed to our lightweight model. Our proposed method does not depend on initial packets or whole flows, and only an arbitrary 3-second traffic block is needed to achieve over 99% accuracy. Moreover, experiments using high-speed network traffic reflect that our approach can identify corresponding applications from RTC media streams in real time. Besides, comparisons with similar work show that this method requires only 1/160th of the memory and 1/10th of the processing time.