Delivering popular short video streaming services like TikTok, Instagram Reels, or YouTube Shorts, poses substantial challenges for service providers and network operators. This is not only due to high download volumes but also due to high-volume pre-loading strategies that cause high bandwidth demand variations. These strategies, designed to reduce initial delays, can additionally lead to bandwidth excess when users swipe quickly through videos and consume only a fraction of downloaded content. This creates inefficiencies and unbalanced network resource utilization, particularly in competitive bandwidth environments. To address these challenges, we investigate the effectiveness of bandwidth capping in this paper, i.e., limiting the throughput of video flows in the network. We conduct measurement studies to analyze the impact of capping on network interactions and Quality of Experience (QoE) of three popular short video services in different scenarios. We find that capping substantially reduces download volume (15% -- 45% median reduction) and bandwidth excess (18% -- 52% mean reduction), while bandwidth utilization fairness improves. Meanwhile, QoE surprisingly remains nearly unaffected in most cases, with only minor statistical differences in a few scenarios.

Short-form video (SFV) services, such as TikTok and Instagram Reels, have rapidly gained widespread popularity, accumulating billions of users. However, evaluating Quality of Experience (QoE) for these services poses challenges as they are typically consumed in mobile and interactive settings. In this paper, we introduce a novel QoE evaluation framework for SFV, which allows for a controlled presentation of stimuli and a reliable collection of valid QoE ratings in an unsupervised setting, while maintaining the authenticity of the mobile, interactive SFV experience. We use our framework to conduct two QoE studies on the impact of waiting times, i.e., initial delay and stalling, on the QoE of SFV via crowdsourcing. Our findings reveal that initial delay results in a three times higher probability that users swipe to the next video within the first ten seconds compared to stalling. In contrast, the Mean Opinion Score (MOS) of stalling is up to 0.4 lower than initial delay for the same waiting time conditions. These insights provide valuable guidelines for optimizing SFV content delivery to enhance user satisfaction, but also highlight the need for novel QoE models, which can describe not only perceived QoE but also resulting user engagement and behavior.

The popularity of short-form video requires careful planning by service providers and network operators aiming to deliver high Quality of Experience (QoE) while minimizing bandwidth wastage from excessive preloading and unpredictable swiping behavior. Service providers utilize preloading strategies to optimize these trade-offs against their target metrics. In this work, we introduce a Markov model that estimates key quality indicators (KQIs) and bandwidth wastage for common preloading strategies, network conditions, and swiping behaviors. We compare two preloading strategies and show that the number of preloaded segments per video results in a trade-off between initial delay and stalling. Further, we highlight the key impact of swiping behavior on both KQIs and bandwidth wastage.

Modern network monitoring applications often rely on traditional machine learning models conceived for specific analysis tasks, which require extensive feature engineering, retraining for different use cases, and struggle with generalization. This lack of adaptability makes the deployment of AI/ML solutions in network monitoring a daunting task, as each new scenario requires significant reconfiguration, manual tuning, and retraining efforts, undermining the broader adoption of AI/ML for network traffic analysis. Time Series Foundation Models (TSFMs), pre-trained on vast and diverse time-series datasets, offer a promising alternative in the network monitoring realm by enabling zero-shot and few-shot adaptability across different monitoring scenarios. In this work, we explore the potential of TSFMs for network monitoring by evaluating their performance in a challenging analysis task: estimating video streaming Quality of Experience (QoE) from encrypted network traffic. Our study assesses the zero-shot and few-shot capabilities of state-of-the-art TSFMs, the impact of time-series granularity, and the role of common traffic features in performance. Using real-world video streaming QoE datasets, we show that TSFMs achieve competitive results in a zero-shot setting – plug-and-play approach, and that their performance can be easily and cost-effectively improved through few-shot learning techniques, even when applied on NetFlow-like features with coarse granularity. Beyond the specific video streaming QoE monitoring application, our findings demonstrate the viability and broader applicability of TSFMs to network monitoring tasks, opening the door to more scalable and generalizable network management solutions.

The increasing complexity and frequency of cyber attacks require Network Intrusion Detection Systems (NIDS) that can adapt to evolving threats. Artificial intelligence (AI), particularly machine learning (ML), has gained increasing popularity in detecting sophisticated attacks. However, their potential lack of interpretability remains a significant barrier to their widespread adoption in practice, especially in security-sensitive areas. In response, various explainable AI (XAI) methods have been proposed to provide insights into the decision-making process. This paper investigates whether these XAI methods, including SHAP, LIME, Tree Interpreter, Saliency, Integrated Gradients, and DeepLIFT, produce similar explanations when applied to ML-NIDS. By analyzing consensus among these methods across different datasets and ML models, we explore whether an agreement exists that could simplify the practical adoption of XAI in cybersecurity, as similar explanations would eliminate the need for rigorous selection processes. Our findings reveal varying degrees of consensus among the methods, suggesting that while some align closely, others diverge significantly, highlighting the need for careful selection and combination of XAI tools to enhance trustworthiness in real-world applications.

Artificial Intelligence (AI), particularly Machine Learning (ML), has become prominent in network monitoring, yet its practical adoption, such as for anomaly and intrusion detection, remains limited. Standard AI/ML methods often exclude experts, reducing trust and hindering practical implementations. Active Learning (AL) allows to integrate admins and their expert knowledge into the ML loop by leveraging expert-labeled data. Together with self-training and automated decisions, AL can enhance model performance, trust, and the ability to adapt to system changes. In this work, we evaluate uncertainty-based AL in network monitoring, offering a comprehensive parameter study for best practices in real-world AI/ML adoption. To this end, we evaluate stream-based and pool-based AL across four datasets for various monitoring use cases and conduct a parameter study on ten uncertainty measures, thereby identifying scenarios benefiting from self-training. By analyzing the impact of admin competence on model performance, we offer actionable guidelines towards the practical implementation of AL.

The integration of web and video applications as dominant Internet content has underscored the importance of Quality of Experience (QoE) for user satisfaction, retention, and digital service success. While current research has extensively studied QoE for individual stimuli, such as web page loading or video streaming, there exists a significant gap in understanding and quantifying QoE for mixed web browsing and video streaming sessions. This paper addresses the critical need to evaluate session QoE when web and video stimuli are combined within a single web session. Employing a crowdsourcing methodology, we investigate the impact of session length, content type, and individual stimuli QoE on the overall session QoE through a full factorial design with both unimpaired and impaired stimuli. Based on these results, we evaluate the applicability of various models to accurately estimate session QoE from information about individual stimuli, offering insights into optimizing the subjective experience in web sessions.

In this paper, we present QoEXplainer, a QoE dashboard for supporting humans in understanding the internals of an explainable, data-driven Quality of Experience model. This tool leverages Large Language Models and the concept of Mediators to convey relevant explanations to the user in an understandable, chatbot-like fashion. For this purpose, our tool QoEXplainer integrates a data-driven video streaming QoE model and techniques from Explainable Artificial Intelligence. The resulting data-driven model explanations are illustrated in the dashboard and users can interact with the chatbot to ask questions about the data and QoE model and control the dashboard to enhance model understanding. With this hybrid demo, we aim to conduct a live study at QoMEX 2024 to evaluate Mediators in the context of (data-driven) QoE modelling with domain experts.

Network operators require real-time traffic monitoring insights to provide high performance and security to their customers. It has been shown that artificial intelligence and machine learning (ML) can improve the visibility of telemetry systems, especially with encrypted traffic. However, current solutions cannot cope with high traffic rates and volumes in large-scale networks. To realize the ML-driven network intelligence paradigm at terabit scale, we design Marina, a system that spreads monitoring over a highly efficient data plane, which can extract traffic statistics at line rate, and a powerful ML server, which can run monitoring inference using complex ML models. We apply temporal microaggregation into sub-second time slots and extract moment-based statistics. These allow to flexibly obtain accurate ML-based monitoring decisions during the next time slot. To demonstrate the scalability of our design, we implement and evaluate a Marina data plane prototype on a Barefoot Wedge 100BF-65X P4 switch, which can monitor more than 520,000 concurrent flows at full switching capacity of 6.4 Tbps. We validate the analytics capabilities enabled by our Marina implementation for four ML-driven real-time monitoring tasks with a broad set of standard ML models, achieving comparable or better than state-of-the-art results.

Data-driven QoE modelling using Machine Learning (ML) allows to reduce the modelling bias and to continuously integrate new QoE results into the QoE model, which can improve its generalizability. The downside is that the majority of ML models are black-box models, which prevent to obtain insights about QoE influence factors and their fundamental relationships that are highly relevant for researchers and providers of services and networks. However, recent advances in the field of eX-plainable Artificial Intelligence (XAI) resolve these issues. Thus, XAI allows to benefit from data-driven QoE modelling to obtain generalizable QoE models, and at the same time to understand what QoE factors are relevant and how they affect the QoE score. In this work, we showcase the feasibility of explainable data-driven QoE modelling for video streaming, since video streaming QoE has been well researched, and thus, allows us to validate our results. Finally, we discuss opportunities and challenges of deploying XAI for QoE modelling.

We introduce DeepCrypt, a deep-learning based approach to analyze YouTube adaptive video streaming Quality of Experience (QoE) from the Internet Service Provider (ISP) perspective, relying exclusively on the analysis of encrypted network traffic. Using raw features derived on-line from the encrypted stream of bytes, DeepCrypt infers six different video QoE indicators capturing the user-perceived performance of the service, including the initial playback delay, the number and frequency of rebuffering events, the video playback quality and encoding bitrate, and the number of quality changes. DeepCrypt offers deep visibility into the behavior of the end-user, enabling the fingerprinting and detection of different user actions on the video player, such as video pauses and playback scrubbing (forward, backward, out-of-buffer), offering a complete visibility on the video streaming process from in-network traffic measurements. Evaluations over a large and heterogeneous dataset composed of mobile and fixed-line measurements, using the YouTube HTML5 player, the native YouTube mobile app, as well as a generic HTML5 video player built on top of open source libraries, and considering measurements collected at different ISPs, confirm the out-performance of DeepCrypt over previously used shallow-learning models, and its generalization to different video players and network setups.

This work presents a novel concept for learning embeddings from encrypted network traffic. In contrast to existing approaches, we evaluate the feasibility of hierarchical embeddings by iteratively aggregating packet embeddings to flow embeddings, and flow embeddings to trace embeddings. The hierarchical embedding concept was designed to especially consider complex dependencies of Internet traffic on different time scales. We describe this novel embedding concept for the domain of network traffic in full detail, and evaluate its performance for the downstream task of website fingerprinting, i.e., identifying websites from encrypted traffic, which is relevant for network management, e.g., as a prerequisite for QoE monitoring or for intrusion detection. Our evaluation reveals that embeddings are a promising solution for website fingerprinting as our model correctly labels up to 99.8% of traces from 500 target websites.

Providing sophisticated web Quality of Experience (QoE) has become paramount for web service providers and network operators alike. Due to advances in web technologies (HTML5, responsive design, etc.), traditional web QoE models focusing mainly on loading times have to be refined and improved. In this work, we relate Google's Core Web Vitals, a set of metrics for improving user experience, to the loading time aspects of web QoE. To this end, we first perform objective measurements in the web using Google's Lighthouse. To close the gap between metrics and experience, we complement these objective measurements with subjective assessment by performing multiple crowdsourcing QoE studies. In these studies, we use CWeQS, a customized framework to emulate the entire web page loading process, and ask users for their experience while controlling the Core Web Vitals. Our results suggest that the Core Web Vitals have less predictive value for web QoE than expected and that page loading times remain the main influence factor in this context.

Web browsing has become the most important application of the Internet for the end user. When it comes to mobile devices, web services are mainly accessed through apps. This paper tackles the problem of Web Quality of Experience (QoE) in mobile devices, with a specific focus on apps QoE monitoring and analysis, using in-network (encrypted) traffic measurements. Measuring apps QoE is complex, not only from an instrumentation point of view, but also from the heterogeneity of user interactions which might realize substantially different user experience. To this end, we conduct a feasibility study on four specific and popular Android apps and their corresponding web services. Our test automation framework emulates and measures different user interactions commonly executed during an app session, including the app startup, clicking, scrolling, and searching. The resulting traffic is characterized on different dimensions, and machine learning models are trained to identify web services, apps, and user interactions, and to infer their QoE. The proposed models can correctly identify the specific web service and app in 86% of the cases and accurately estimate the associated QoE with small errors. Our preliminary study represents a first step towards an in-network, web QoE monitoring solution for mobile-device apps.

Education Service Providers (ESPs) have a paramount role in the digitization of education, providing reliable devices for students and teachers and high quality Internet access at schools. In this paper, a large-scale, passive, in-device Quality of Experience (QoE) monitoring system is presented, which was deployed into a nationwide network of education-purpose devices. Four months' worth of continuous measurements were conducted by an ESP, covering more than 800 education centers and about 4000 devices, used both in schools and at home. When analyzing the QoE of web sessions in school networks, we identify a fundamental issue with the compatibility of web browsing and video QoE models, which inhibits the successful application of QoE-aware network management for multiple services.

Web browsing is one of the key applications of the Internet, if not the most important one. We address the problem of Web Quality-of-Experience (QoE) monitoring from the ISP perspective, relying on in-network, passive measurements. As a proxy to Web QoE, we focus on the analysis of the well-known SpeedIndex (SI) metric. Given the lack of application-level-data visibility introduced by the wide adoption of end-to-end encryption, we resort to machine-learning models to infer the SI and the QoE level of individual web-page loading sessions, using as input only packet- and flow-level data. In this paper, we study the impact of different end-user device types (e.g., smartphone, desktop, tablet) on the performance of such models. Empirical evaluations on a large, multi-device, heterogeneous corpus of Web-QoE measurements for the most popular websites demonstrate that the proposed solution can infer the SI as well as estimate QoE ranges with high accuracy, using either packet-level or flow-level measurements. In addition, we show that the device type adds a strong bias to the feasibility of these Web-QoE models, putting into question the applicability of previously conceived approaches on single-device measurements. To improve the state of the art, we conceive cross-device generalizable models operating at both packet and flow levels, offering a feasible solution for Web-QoE monitoring in operational, multi-device networks. To the best of our knowledge, this is the first study tackling the analysis of Web QoE from encrypted network traffic in multi-device scenarios.

Large-scale events pose severe challenges to live video streaming service providers, who need to cope with high, peaking viewer numbers and the resulting fluctuating resource demands, keeping high levels of Quality of Experience (QoE) to avoid end-user frustration and churn. In this paper, we analyze a unique dataset consisting of more than a million 2018 FIFA World Cup mobile live streaming sessions, collected at a large national public broadcaster. Different from previous work, we analyze QoE and user engagement as well as their interaction, in dependency to specific soccer match events, which have the potential to trigger flash crowds during a match. Flash crowds are a particular challenge to video service providers, since they cause sudden load peaks and consequently, the likelihood of quality problems. We further exploit the data to model viewer engagement over the course of a soccer match, and show that client counts follow very similar patterns of change across all matches. We believe that the analysis as well as the resulting models are valuable sources of insight for service providers, equipping them with tools for customer-centric resource and capacity management.

When conducting video QoE studies participants are usually asked to rate the QoE of prepared test videos. However, participants are given no choice to select content, which they like or in which they are interested. This may cause annoyance or frustration when conducting the QoE study, which eventually might affect the QoE results of the study. The consequent question is whether the content liking has a direct impact on the submitted ratings by the participants and whether the freedom of choosing the video content in QoE studies results in better ratings. To investigate this research question, CroQoE, an existing framework for crowdsourced video testing, is extended and used in a pilot field study. In this work, the results of a QoE study with individual and dynamic content selection are compared to a QoE study with pre-selected contents. Moreover, this work includes a comparison to a previous QoE study for validation. As the previous study was conducted on desktop PCs, the CroQoE study further allows to identify differences in the stalling perception between studies on desktop PCs and mobile devices.

Over the last years, QUIC (Quick UDP Internet Connections) has become the default protocol for networked communication of Google services, heralded as improved successor of the prevailing Transport Control Protocol (TCP). While the deployment of QUIC is increasing, QUIC is also planned to be the foundation of HTTP/3, the next generation of the HTTP protocols, which drive almost all applications on the Web. Given these developments, this paper aims to raise the awareness of the QoE research community to the increasing presence of QUIC, which likely brings implications for QoE monitoring and management of networked multimedia applications, as well as for the overall QoE research agenda. In particular, a major promise during the introduction of QUIC has been the improvement of the QoE of web-based applications (like browsing and video) by overcoming certain limitations and inefficiencies of TCP. In order to validate this claim, a measurement study was conducted to test whether the promised QoE benefits of QUIC are indeed noticeable for end users of streaming and browsing services. Surprisingly, no evidence for any QoE improvement of QUIC over TCP could be found. This way this paper aims to demonstrate how QoE research can and should successfully address relevant current and future developments on the Internet.

This paper presents a novel adaptation logic for HTTP adaptive streaming (HAS), which achieves not only a high quality of experience (QoE) but also high QoE fairness among independent and heterogeneous clients. The algorithm forces video clients to adapt the requested quality level based on the current network conditions and their individual bit rate requirements, such that the overall quality levels selected by all currently active streaming clients are fairly distributed, i.e., they do not diverge too much. The design of the algorithm is inspired by the well-known transmission control protocol (TCP) congestion control, and drives heterogeneous clients to independently converge on similar quality levels without the need for communicating with each other and/or with a centralized controller in the network. By defining quality levels with equal visual quality, and preparing video representations accordingly, the quality level fairness is extended to QoE fairness. In this paper, the design of the TCP-inspired adaptation logic (TCPAL) is described and a simulative performance evaluation is conducted to compare the QoE and QoE fairness of the proposed algorithm with other HAS adaptation logics. TCPAL is evaluated both in scenarios with stable and fluctuating streaming capacity, and the impact of its parameters is explored. The results suggest that TCPAL performs on par with other HAS adaptation logics in terms of QoE and QoE fairness for low link capacities, but significantly improves the QoE fairness for increased link capacity. Moreover, the fairness achieved by TCPAL does not degrade in situations with fluctuating streaming capacity.

The number of smartphones connected to wireless networks and the volume of wireless network traffic generated by such devices have dramatically increased in the last few years, making it more challenging to tackle wireless network monitoring applications. The high-dimensionality of network data provided by current smartphone devices opens the door to the massive application of machine learning approaches to improve different wireless networking applications. In this paper we study the specific problem of Quality of Experience (QoE) prediction for popular smartphone apps, using machine learning models and in-smartphone measurements. We evaluate and compare different models for the analysis of smartphone generated data, including single models as well as machine learning ensembles such as bagging, boosting and stacking. Results suggest that, while decision-tree based models are the most accurate single models to predict QoE, ensemble learning models, and in particular stacking ones, are capable to significantly increase accuracy prediction and overall classification performance.

P.1203 is a recent standardized model for assessing the Quality of Experience (QoE) of HTTP Adaptive Video Streaming (HAS). However, its complex definition does not allow for a straightforward identification of the underlying assumptions. To overcome this issue, this work investigates the impact of the well-known QoE factors of HAS, namely, initial delay, stalling, and adaptation, on the output QoE score of the model. Therefore, parameter studies are conducted using a reference implementation of P.1203, and the model response to variations of the input QoE factors are compared to results of previous QoE studies in order to get a deeper understanding of the standardized model and its inherent weighting of the QoE factors of HAS.

YoMoApp (YouTube Monitoring App) is an Android app to monitor mobile YouTube video streaming on both application- and network-layer. Additionally, it allows to collect subjective Quality of Experience (QoE) feedback of end users. During the development of the app, the stable versions of YoMoApp were already available in the Google Play Store, and the app was downloaded, installed, and used on many devices to monitor streaming sessions. As the app was not advertised in special campaigns or used for dedicated QoE studies, the monitored streaming sessions of this period compose the data set of a large unsupervised field study. The collected data set is evaluated to characterize current mobile YouTube streaming on both application and network layers. Furthermore, the problems and methodology to obtain QoE results from such unsupervised field study are discussed together with the actual QoE results. Correlations between QoE factors are investigated, and the QoE of clusters of similar streaming sessions is analyzed.