Internet Service Providers (ISPs) bear the brunt of being the first port of call for poor video streaming experience. ISPs can benefit from knowing the user's device type (e.g., Android, iOS) and software agent (e.g., native app, Chrome) to troubleshoot platform-specific issues, plan capacity and create custom bundles. Unfortunately, encryption and NAT have limited ISPs' visibility into user platforms across video streaming providers. We develop a methodology to identify user platforms for video streams from four popular providers, namely YouTube, Netflix, Disney, and Amazon, by analyzing network traffic in real-time. First, we study the anatomy of the connection establishment process to show how TCP/QUIC and TLS handshakes vary across user platforms. We then develop a classification pipeline that uses 62 attributes extracted from the handshake messages to determine the user device and software agent of video flows with over 96% accuracy. Our method is evaluated and deployed in a large campus network (mimicking a residential broadband network) serving users including dormitory residents. Analysis of 100+ million video streams over a four-month period reveals insights into the mix of user platforms across the video providers, variations in bandwidth consumption across operating systems and browsers, and differences in peak hours of usage.

翻译：互联网服务提供商（ISP）首当其冲地成为视频流体验不佳时的首要求助对象。了解用户的设备类型（如Android、iOS）和软件代理（如原生应用、Chrome）有助于ISP排查平台特定问题、规划容量并创建定制套餐。然而，加密和网络地址转换（NAT）限制了ISP对不同视频流提供商用户平台的可见性。本文提出一种实时分析网络流量的方法，用于识别来自YouTube、Netflix、Disney和Amazon四大主流视频提供商的用户平台。首先，我们通过研究连接建立过程的结构，揭示TCP/QUIC与TLS握手协议在不同用户平台间的差异。随后构建分类流水线，从握手消息中提取62个特征属性，以超过96%的准确率判定视频流的用户设备与软件代理。该方法在模拟住宅宽带网络的大型校园网络（涵盖宿舍用户）中完成评估与部署。通过对四个月内超1亿条视频流的分析，揭示了以下发现：不同视频提供商的用户平台构成差异、操作系统与浏览器间的带宽消耗变化，以及使用高峰时段的分布特征。