Traffic spills the beans: A robust video identification attack against YouTube

Traffic-based video identification attack is a side-channel attack that allows an attacker to identify transmitted online videos from encrypted network traffic. Existing attacks face two types of challenges: 1) YouTube's improved streaming technology renders them invalid or impacted; 2) real-world diverse traffic makes them underperform. In this paper, we provide the first study of YouTube's technical improvements and reveal its three key features: i) the mechanism that replaces the MPD file, ii) variable combined segments, and iii) various buffering processes. Based on the above analysis, we propose a Robust and easily scalable Video Identification Attack against YouTube called RoVIA. RoVIA extracts video fingerprints from video file headers and reference sequences from video traffic. RoVIA uses the reference sequence to generate candidate sequences in the pre-built video fingerprint library and achieves video identification by measuring sequence similarity. Experimental results show that RoVIA achieves open-world accuracy of 0.967, 0.924, and 0.863 in open-world, fixed-quality, and poor network experiments. Furthermore, RoVIA's scalability allows the target classes to be adjusted by updating the fingerprint library without collecting new samples and retraining parameters. This study aims to demonstrate the vulnerabilities of YouTube streaming technology and the potential consequences of its malicious use. We also propose two YouTube-friendly countermeasures to help developers build effective defenses.