Identifying Fine-Grained Douyin User Behaviors via Analyzing Encrypted Network Traffic

Smartphones and mobile Internet development have promoted the rise of short video applications. Douyin, the most popular short video application in China, has very complex in-app functions. Due to users’ need for privacy protection, encryption protocols are widely used. But it also makes it difficult to supervise malicious user behaviors. The encrypted traffic of Douyin user behaviors has the characteristics of a small sample and instantaneity. It is easy to be covered by the huge background traffic, which brings challenges to the research of Douyin user behavior identification. To solve this problem, we first proposed an automated method for labeling encrypted traffic of Douyin user behaviors based on multistage packet filtration technology, which can improve labeling efficiency and sample purity. Secondly, we propose a multi-layer identification method to identify Douyin user behaviors. Specifically, we first analyze the global and local characteristics of Douyin traffic to identify user behavior flows. Then, the user behavior flow is segmented into packet subsequences based on the local burstiness of the user behavior traffic. Finally, we extract the features of subsequences to identify Douyin user behaviors. The results can achieve an average of 0.980 precision, 0.966 recall, and 0.971 f1-score.