Piracy Shield May Reduce Illegal Sports Streaming, Traffic Analysis Suggests

Italy's Piracy Shield blocking system was launched early 2024 promising to end the flood of pirate IPTV providers saturating the local market. Site-blocking proponents' claims of huge success were met by reports of significant failures. In the absence of any useful, credible data being made available by those behind Piracy Shield, researchers in Italy are trying to answer the big question: Is Piracy Shield effective at reducing access to pirated live sports streams?

Piracy Shield’s first birthday is still several months away so the appearance of a study into its effectiveness came as a surprise but not an unwelcome one.

Commentary by Italian telecoms regulator AGCOM, mirrored by top-tier football league Serie A and streaming service DAZN, hasn’t been at all useful for those seeking answers to the two most important questions:

1) How effective is Piracy Shield at denying access to pirate live sports streams?
2) What is the effect (if any) on new subscriber uptake and customer churn?

Thus far, success has been expressed via the number of domains and IP addresses added to the system for blocking. With roughly 25,000 domains and IP addresses currently blocked, and huge numbers added week after week, the need for more blocking is just as easily framed as a measure of failure.

How Effective is Piracy Shield?

A study to measure how effective Piracy Shield is at blocking was recently conducted at the University of Padua. Graduate student Maffei Davide and Prof. Alessandro Galeazzi, with support from Dr. Giacomo Quadrio and Dr. Enrico Bassetti of the SPRITZ security group, opted for an analysis of network traffic via the university’s VSIX[g] node.

“The project was born from the need to collect information on the functioning of Piracy Shield, as well as on the evaluation of its effectiveness. Through the analysis of network flows, we want to be able to distinguish video flows from other types of traffic and identify the differences between ordinary and pirated traffic,” David Maffei explains.

Using traffic analysis, the researchers examined various characteristics such as communication protocols (TCP, UDP), network ports commonly associated with streaming services, stream duration and size, and packet flags signaling successful transmission and reception.

Through the analysis of these and other characteristics, the researchers aimed to isolate video streaming traffic from other network activity. The next task was to isolate likely legal streaming traffic, from traffic likely to be illegal.

Identifying Legal Streaming Traffic

To identify streaming traffic likely to be legal, the researchers needed to establish which companies hold the broadcast rights for the sporting events being analyzed. After identifying Sky and DAZN, the next step was to discover their Content Delivery Network (CDN) partners; in this case, both Sky and DAZN mainly use Akamai.

The next stage required the researchers to determine the IP addresses generating network traffic coinciding with football match broadcasts. The paper provides additional detail but in broad terms, the researchers considered i) average traffic rate (between 1 and 20Mbps), ii) consistent traffic patterns (to exclude addresses with high traffic peaks unrelated to streaming), and iii) significant difference in traffic during match time, when compared with the two-hour slots before and after a game.

After identifying the Content Delivery Network (in this case Akamai) used for legal broadcasts and finding the corresponding Autonomous System Numbers (ASN), the researchers were able to reconstruct the legal streaming traffic to generate a legal traffic baseline, as illustrated in the image below.

Legal traffic baseline (May 2024)

This baseline allowed the researchers to compare legal traffic with suspected illegal traffic.

Identifying Suspected Illegal Streaming Traffic

The researchers began by identifying the most-used network ports used during the match period; overwhelmingly ports 443 (https) and 80 (http) in the top 50.

The data generated by these high-traffic ports was analyzed to detect network flows with similar characteristics to those associated with video streaming, following the pattern of legal traffic established in the baseline. To facilitate identification, traffic graphs were generated for each port, with port 41122 producing a very similar profile to the legal baseline.

Among many checks carried out to ensure that traffic was actually illegal, the researchers compared this traffic with traffic generated by ASNs linked to websites previously blocked for copyright infringement. Again, the finer details are available in the full report.

Piracy Shield: Effective or Not?

When referencing Piracy Shield, the researchers appear to take the whole system into consideration, from the detection and identification of pirate streams by affected rightsholders, to the eventual blocking of domains and IP addresses by ISPs.

Key metrics the researchers wanted to consider but were forced to leave out, include detection rates, false positive rates, response times, and efficient management of IP addresses and availability. The researchers cite limited data availability and a general lack of transparency throughout the system as obstacles to more comprehensive research.

To evaluate the effectiveness of Piracy Shield, the researchers compared legal traffic with suspected illegal traffic. The image below shows data reconstructed from traffic generated by ASNs associated with IP addresses blocked by Piracy Shield (orange) and separately identified legal traffic (blue).

“The graph highlights that illegal traffic presents significant volume peaks at football match times, indicated by the vertical dotted lines. These peaks coincide temporally with the start an end of sports events, suggesting a strong correlation between presumed pirate traffic and the unauthorized transmission of sports content,” the report notes.

The paper notes difficulties in identifying specific patterns related to illegal video streaming (orange), although a clear pattern typical of streaming did emerge. On the other hand, legal traffic (blue) shows smaller fluctuations.

A more concerning finding for rightsholders is the volume of suspected illegal streaming, which at times overlaps with legal streaming traffic, further complicating the task of distinguishing legal from illegal traffic. More sophisticated algorithms and filtering techniques may be needed to improve identification accuracy.

Conclusion: “Some Effectiveness”

Overall, the results of the traffic analysis suggest that Piracy Shield demonstrated “some effectiveness” in reducing illegal traffic but the scale of the impact – and of course any effect on subscription uptake – is beyond the scope of the study.

The continued availability of pirate sites and the ability of users to circumvent blocking are cited as key concerns, along with strong negatives concerning the platform itself.

Rightsholders’ ability to implement blocking without supervision, meets a lack of transparency and scrutiny in general, and the suggestion of unaccountability. Implications for net neutrality are also raised as a concern.

Whether “some effectiveness” justifies the imposition of the many negatives on everyone except Italian football, will remain a lively topic of debate. There seems little here to inspire confidence that it’s all been worthwhile, but that may be challenged once the first comprehensive rightsholder-funded research sees the light of day.

Evaluation of the Effects of Piracy Shield Through Video Stream Analysis and Its Operation (pdf)

Source

RIP Matrix | Farewell my friend  

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

2023: Over 5,800 news posts | 2024 (till end of September): 4,292 news posts