OPEN-WORLD VIDEO STREAM FINGERPRINTING

Abstract

Network traffic fingerprinting threatens the security and privacy of streaming video on the web, but there are questions about its effectiveness that we aim to answer through more rigorous testing. We first collect a novel dataset to support both our own investigation and the work of future researchers. We then test the existing video stream fingerprinting approach in larger and more realistic open-world scenarios, followed by a variety of more advanced techniques drawn from the literature on open set recognition, out-of-distribution detection, and robustness to adversarial examples. Our contributions include the dataset and a number of findings. We find that: fingerprinting can pose a compelling threat even when users stream video over Tor; however, even with a modest open-world recall goal, the base rate problem would make the existing approach ineffective at the scale of the largest platforms hosting hundreds of millions or more videos; combinations of more advanced techniques can substantially reduce the open-world false positive rate compared to the baseline, but introducing two other dimensions of realism can greatly increase the false positive rate even when closed-world accuracy remains near perfect. Accordingly, we call for future work to focus primarily on large open-world scenarios, rather than small closed-world scenarios, building on our approach to measuring and reasoning about the effectiveness of fingerprinting at scale.