MESA Lab researchers built and iterated a Scapy-based website-fingerprinting classifier that identifies specific YouTube videos from encrypted traffic by matching the packet-size sequence of thumbnail-image requests (triggered on SNI yt3.googleusercontent.com / yt3.ggpht.com) against a pre-built reference dataset (dataset_24_youtube_fingerprints.csv), scoring candidate matches on sequence overlap and total-payload-size ratio against fixed thresholds (0.65 / 0.85).
if 'yt3.googleusercontent.com' in CHO_payload or 'yt3.ggpht.com' in CHO_payload: test_s = generate_fingerprint(flows[flow_key]); handle_test_sample(test_s)
Defense implications
- Padding or randomizing the size/count of small auxiliary sub-resource fetches (thumbnails, favicons, etc.) that accompany a page load defeats this class of image-count/size-sequence fingerprinting.
- A transport that reorders or pads sub-resource fetch timing so it no longer mirrors the underlying page's fixed structure blunts classifiers built on stable per-page packet-size sequences like this one.
Related findings
An Aug 2024 internal R&D presentation ("加密视频流量识别研究概述") describes a working encrypted-video content-fingerprinting system that builds per-(video_id, itag) chunk-size-sequence fingerprints from 1000+ YouTube videos (first 600s each, collected at multiple network vantage points) and matches live DASH/HLS chunk-size sequences against that library in real time, achieving 96%+ title-identification accuracy from just 6 chunks (~12 seconds of playback) with microsecond match latency; the system is currently passive-observation only, with the team explicitly noting they don't know whether enabling active blocking on this signal would prompt the server side to adopt randomized padding as a countermeasure.
A 2020 IIE CAS master's thesis (author and advisor names redacted) develops ML methods to identify audio/video traffic within encrypted flows without payload inspection, by quantifying on/off transmission burst patterns and binning long packet-length/timing sequences into short fixed-length feature vectors usable from as little as 5 seconds of traffic, plus a lightweight heuristic-threshold variant with a congestion-correction feature scheme built into a deployed identification system.
A 2024 IIE/CAS PhD opening-report (author and advisor names redacted) lays out a four-part research plan for identifying specific encrypted video content transmitted over QUIC: (1) recovering per-video traffic fingerprints from downlink packet aggregation despite QUIC's full encryption, using linear-fit correction to reconstruct true video-chunk sizes; (2) matching randomized multi-segment video combinations via a random-walk segment model plus a traffic 'language model'; (3) a Siamese attention-CNN with contrastive learning to fingerprint-match mixed audio/video segment streams; and (4) a large-model-based classifier to keep fingerprint matching robust under network degradation and varied playback modes.
A 2023 master's thesis from the Institute of Information Engineering, Chinese Academy of Sciences (MESA Lab's parent institute) develops an online encrypted-video-stream title identification method using response-time distribution and chunk-fingerprint matching that survives CDN node switching, reporting 96.19% title-identification accuracy using only 6 observed video chunks, without decrypting traffic.
A master's thesis-in-progress supervised within this ecosystem (advisor name redacted, senior engineer) is explicitly tied to the national key R&D program "海量公害 网页、图片、视频流量识别技术" (massive nuisance webpage/image/video traffic identification technology) and a VoIP engineering project; it builds cross- platform (YouTube/Facebook/Bilibili) encrypted-video identification that matches a single per-video traffic fingerprint across different CDNs/resolutions/codecs via trend-similarity, fuzzy-search, and meta-learning matching, explicitly framed around detecting "非法视频" (illegal/harmful video) spread across platforms.
A MESA team ("第二研究室 Mesa团队", lead name redacted) technical overview describes the traffic-classification engine underlying TSG/sapp as performing deep field-level parsing across 29 protocols (HTTP with 32 standard + 400+ extended fields; SMTP/POP3/IMAP/DNS/FTP/RTSP/RTMP/HLS/DASH/ SSL/SSH/OpenVPN/BT etc.), and identifies VPN traffic specifically via a two-stage approach -- coarse protocol-signature classification followed by fine-grained statistical/behavioral-feature classification for traffic that can't be matched by signature alone.