OLIViS: An OSINT-Based Lightweight Method for Identifying Video Services in Backbone ISPs

As of 2022, 66% of Internet traffic is generated by video services, among which Netflix and YouTube are the dominant players. By monitoring the traffic volume of individual video services, ISPs (Internet Service Providers) can make appropriate capital investments and determine appropriate peering policies with CDN (Content Delivery Network) providers. Although DPI (Deep Packet Inspection) is widely used to identify network services, packet-level analysis does not scale to the traffic passing through backbone ISPs and is inapplicable to encrypted packets. This paper proposes OLIViS (OSINT-based Lightweight method for Identifying Video Services), a flow-level, label-free method designed for backbone ISPs. OLIViS employs a CNN-VAE (Convolutional Neural Network - Variational AutoEncoder) model to initially identify elephant flows which likely include video service flows and then utilizes OSINT (Open Source INTelligence) data for further services identification. Two datasets are used for evaluation: UTMobileNet2021 and WIDE backbone real trace. The evaluation results show that OLIViS identifies the Netflix and YouTube flows with an accuracy of over 96% in terms of traffic volume. Moreover, OLIViS infers the flow statistics (e.g., mean and peak throughput) of Netflix and YouTube, which closely resemble those inferred with DPI on non-encrypted traffic in a campus network.