A 2023 master's thesis from the Institute of Information Engineering, Chinese Academy of Sciences (MESA Lab's parent institute) develops an online encrypted-video-stream title identification method using response-time distribution and chunk-fingerprint matching that survives CDN node switching, reporting 96.19% title-identification accuracy using only 6 observed video chunks, without decrypting traffic.
the method can achieve 96.19% identification accuracy with only 6 online video chunks in the case of video fingerprint chunks missing
Defense implications
- Assume specific video/content titles can be fingerprinted from as few as 6 encrypted chunks even when a CDN switches nodes mid-stream; padding and chunk-size/timing randomization matter for any transport that mimics or tunnels video streaming.
Related findings
A 2020 IIE CAS master's thesis (author and advisor names redacted) develops ML methods to identify audio/video traffic within encrypted flows without payload inspection, by quantifying on/off transmission burst patterns and binning long packet-length/timing sequences into short fixed-length feature vectors usable from as little as 5 seconds of traffic, plus a lightweight heuristic-threshold variant with a congestion-correction feature scheme built into a deployed identification system.
A 2024 IIE/CAS PhD opening-report (author and advisor names redacted) lays out a four-part research plan for identifying specific encrypted video content transmitted over QUIC: (1) recovering per-video traffic fingerprints from downlink packet aggregation despite QUIC's full encryption, using linear-fit correction to reconstruct true video-chunk sizes; (2) matching randomized multi-segment video combinations via a random-walk segment model plus a traffic 'language model'; (3) a Siamese attention-CNN with contrastive learning to fingerprint-match mixed audio/video segment streams; and (4) a large-model-based classifier to keep fingerprint matching robust under network degradation and varied playback modes.
A master's thesis-in-progress supervised within this ecosystem (advisor name redacted, senior engineer) is explicitly tied to the national key R&D program "海量公害 网页、图片、视频流量识别技术" (massive nuisance webpage/image/video traffic identification technology) and a VoIP engineering project; it builds cross- platform (YouTube/Facebook/Bilibili) encrypted-video identification that matches a single per-video traffic fingerprint across different CDNs/resolutions/codecs via trend-similarity, fuzzy-search, and meta-learning matching, explicitly framed around detecting "非法视频" (illegal/harmful video) spread across platforms.
An Aug 2024 internal R&D presentation ("加密视频流量识别研究概述") describes a working encrypted-video content-fingerprinting system that builds per-(video_id, itag) chunk-size-sequence fingerprints from 1000+ YouTube videos (first 600s each, collected at multiple network vantage points) and matches live DASH/HLS chunk-size sequences against that library in real time, achieving 96%+ title-identification accuracy from just 6 chunks (~12 seconds of playback) with microsecond match latency; the system is currently passive-observation only, with the team explicitly noting they don't know whether enabling active blocking on this signal would prompt the server side to adopt randomized padding as a countermeasure.
A 2024 IIE CAS thesis proposal (advisor name redacted, a senior-grade engineer) explicitly frames "website identification under ECH encryption" as necessary infrastructure for China's CAC/MIIT/MPS "Clean Web"/"Sword Net" enforcement campaigns, and reports concrete progress already made: a Go-based DNS active-probing framework scanning 1.7B+ domains at roughly 11,000 domains/sec to build a global ECH-deployment map (10 anonymity sets / 79 domains found as of April 2024), and an already-implemented ECH-flow filter keyed on the TLS extension-type IDs used across ECH draft versions 07-18, with planned work on cross-flow traffic correlation plus raw-byte/flow-feature fusion to identify the specific site within an ECH anonymity set.
An internal "网站/应用资源测绘" (website/app resource-mapping) presentation describes active EDNS-Client-Subnet DNS probing from many simulated geographic vantage points to map Google's and Facebook's global service-IP distribution by country/province, a mobile-app pipeline combining UI automation with MITM-proxy/ SSL-pinning-bypass to extract button-to-URL mappings from decrypted app traffic, and a "网站指纹审查" section that explicitly documents domain fronting as an effective evasion of its own DNS/SNI/Host-based website-fingerprint detection, alongside literature-based behavioral/ML website-fingerprinting intended to survive the QUIC/ECH/DoH transition.