System and method for identifying encrypted, pre-recorded media content in packet data networks

Patent metadata

Field	Value
Publication number	US-12015808-B2
Application number	US-202318185893-A
Country	US
Kind code	B2
Filing date	Mar 17, 2023
Priority date	Apr 23, 2021
Publication date	Jun 18, 2024
Grant date	Jun 18, 2024

Abstract

Aspects of the subject disclosure may include, for example, a device having a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations including receiving encrypted hypertext transport protocol (HTTPS) traffic including media content; separating the HTTPS traffic into audio segments and video segments; calculating a size for each audio segment in the HTTPS traffic; maintaining a sliding window of a plurality of sizes of consecutive audio segments to form a fingerprint; and identifying the media content by matching the fingerprint with a reference in a catalog. Other embodiments are disclosed.

First claim

What is claimed is:

1. A device, comprising:
a processing system including a processor; and
a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising:
calculating a segment size for each encrypted audio segment in encrypted audio segments separated from encrypted hypertext transport protocol (HTTPS) traffic carrying media content;
determining one or more indices from a sliding window of a plurality of segment sizes of consecutive encrypted audio segments, wherein the indices are calculated by summing selected segment sizes in plurality of segment sizes and dividing by a total of sizes of the plurality of segment sizes in the sliding window; and
identifying the media content by matching the indices with a reference in a catalog.

2. The device of claim 1 , wherein the matching calculates a correlation coefficient between the indices and the reference.

3. The device of claim 2 , wherein the correlation coefficient is a Pearson product-moment correlation coefficient.

4. The device of claim 3 , wherein the matching is determined when the correlation coefficient is 99.9% or higher.

5. The device of claim 4 , wherein the catalog is a three-dimensional k-d tree.

6. The device of claim 5 , wherein the sliding window comprises six segment sizes and each index to the catalog is determined by summing a subset of the six segment sizes.

7. The device of claim 6 , wherein each index is a ratio of a first sum of two different segment sizes to a second sum of all sizes of the six segment sizes.

8. The device of claim 7 , wherein each segment size is calculated from transport control protocol sequence numbers for a corresponding segment.

9. The device of claim 1 , wherein the operations further comprise:
calculating a video segment size for each encrypted video segment;
maintaining a second sliding window of a plurality of video segment sizes of consecutive encrypted video segments to form a fingerprint; and
identifying the media content by matching the fingerprint with a second reference in the catalog.

10. The device of claim 1 , wherein the processing system comprises a plurality of processors operating in a distributed computing environment.

11. A non-transitory, machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising:
calculating a segment size for each encrypted segment in encrypted hypertext transport protocol (HTTPS) traffic carrying media content;
determining one or more indices from a sliding window of a plurality of segment sizes of consecutive encrypted segments, wherein each index of the one or more indices are calculated from a mathematical combination of segment sizes in the plurality of segment sizes in the sliding window; and
identifying the media content by matching the indices with a reference in a catalog.

12. The non-transitory, machine-readable medium of claim 11 , wherein the matching calculates a correlation coefficient between the indices and the reference.

13. The non-transitory, machine-readable medium of claim 12 , wherein the matching is determined when the correlation coefficient is 99.9% or higher.

14. The non-transitory, machine-readable medium of claim 13 , wherein the sliding window comprises six segment sizes.

15. The non-transitory, machine-readable medium of claim 14 , wherein each segment size is calculated from transport control protocol sequence numbers for a corresponding segment.

16. The non-transitory, machine-readable medium of claim 15 , wherein the operations further comprise separating the encrypted HTTPS traffic into encrypted audio segments and encrypted video segments; and wherein the plurality of segment sizes is of the encrypted audio segments only.

17. The non-transitory, machine-readable medium of claim 16 , wherein the processing system comprises a plurality of processors operating in a distributed computing environment.

18. A method, comprising:
calculating, by a processing system comprising a processor, a segment size for each encrypted segment in encrypted hypertext transport protocol (HTTPS) traffic including media content;
determining one or more indices, by the processing system, from a sliding window of a plurality of segment sizes of consecutive encrypted segments, wherein each index of the one or more indices is determined by a ratio of a sum of one or more segment sizes in the plurality of segment sizes to a total of the segment sizes in the plurality of segment sizes; and
identifying, by the processing system, the media content by matching the indices with a reference.

19. The method of claim 18 , wherein the reference is stored in a three-dimensional k-d tree.

20. The method of claim 18 , wherein the sliding window comprises six sizes, wherein the matching calculates a correlation coefficient between the one or more indices and the reference, and wherein the matching is determined when the correlation coefficient is 99.9% or higher.

Assignees

• At & T Ip I Lp

Inventors

• Ding Yuan
• Schenck Natalia
• Sanchez Daniel
• Akyol Umut
• Bakst Lawrence E
• Sharma Vinay

Classifications

• H04N21/233 Primary

  Processing of audio elementary streams {(monitoring, identification or recognition of audio in broadcast systems H04H60/58)} · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F17/15

  Correlation function computation {including computation of convolution operations (arithmetic circuits for sum of products per se, e.g. multiply-accumulators G06F7/5443; digital filters, e.g. FIR, IIR, adaptive filters H03H17/00)} · CPC title

• G06F17/18

  for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title