Characterization and identification of Netflix encrypted traffic

Technology evolves quickly, and Netflix has evolved as well since 2017. Microsoft’s Silverlight player has been replaced by Netflix’s own player, video segments do not last strictly for 4 seconds anymore, their catalog keeps expanding, and new video codecs and resolutions have come to stay. The techniques described up to now for identification of Netflix content are now outdated. In this thesis, we are going to demonstrate that the identification of encrypted Netflix videos is still possible nowadays, and we are going to improve the techniques that our preceding works deployed by: ● Perfecting the accuracy of the calculation of segment sizes. None of the methods proposed until now was able to calculate the exact size that a captured segment has. We have implemented a technique which calculates accurately the size of a downloaded video chunk. As we do not have to tackle the lack of precision anymore, we no longer have to use sliding windows paradigms to find matches. ● Reducing encrypted video identification from minutes to just a few seconds. As filling two-minutes sliding windows will no longer be required, the identification process speeds up immensely. Now, we will be able to capture a few segments within a few seconds to firmly determine the played Netflix content in an encrypted capture. ● Improving the technique used to download the entirety of Netflix catalog. A web scraper is used in [2] to determine all movies and TV shows that made up the catalog back then. We are going to use Netflix’s internal API to retrieve all Netflix content without parsing any HTML. ● Improving the technique used to retrieve the sizes of the segments of every video in the catalog.