OTT Media Service Web User Behaviour Analysis and Unethical User Prediction
🔍 What is This Paper About?
This paper focuses on Over-The-Top (OTT) media services — streaming platforms like Netflix, YouTube, Amazon Prime, and similar services that deliver video content over the internet — and tackles two connected problems:
How to analyze user behavior on OTT platforms to understand how people use these services
How to detect and handle "unethical users" — people who access OTT content without proper authorization (account sharers, hackers, unauthorized devices)
The paper proposes a four-stage system that manages content delivery, adapts video quality based on who the user is, stores user data efficiently, and collects feedback — all while identifying and penalizing unauthorized users automatically.
🌍 Why Does This Matter?
OTT streaming is one of the biggest industries on the internet today. As more people stream video, platforms face serious challenges:
Bandwidth costs — delivering high-quality video to millions of users is expensive
Unauthorized access — people sharing accounts or hacking into systems cost platforms revenue
Quality of experience — users expect smooth, buffer-free playback regardless of their internet speed or device
Scalability — the system must handle millions of simultaneous users without crashing
This paper proposes a unified technical framework that addresses all of these challenges at once.
🏗️ The Four-Stage System Architecture
The entire proposed system works in four interconnected stages:Stage 1: PCDN (Peer-to-Peer Content Delivery Network) ↓ Delivers content efficiently to users Stage 2: Selective Destination Bitrate-Adaptivity (ABS) ↓ Adjusts video quality based on user authorization Stage 3: NFV-Enabled Multi-Access Edge Data Centers (MEC) ↓ Manages user data, load balancing, and QoE Stage 4: Review of Recommender System ↓ Collects and evaluates user feedback, flags unauthorized reviews
🛠️ Technologies and Techniques Used
📡 STAGE 1 — PEER-TO-PEER CONTENT DELIVERY NETWORK (PCDN)
1. Content Delivery Network (CDN) A CDN is a geographically distributed network of servers that stores copies of video content close to where users are located. Instead of everyone downloading from one central server (which would be slow and expensive), the CDN serves content from the nearest edge server — drastically reducing loading times and buffering.
Key functions of CDN:
Caching — stores copies of frequently accessed content at edge servers
Load balancing — spreads user requests across multiple servers to prevent any single server from being overwhelmed
Request routing — automatically directs each user's request to the closest and least-congested server
Reduced network congestion — less traffic travels across long distances
2. Peer-to-Peer (P2P) Network In a P2P network, users share content directly with each other without relying on a central server. Each user (peer) both downloads content AND uploads portions of that same content to other nearby users simultaneously. This makes the system more resilient and scalable — the more users there are, the more bandwidth is available.
3. PCDN (P2P + CDN Hybrid) The paper combines both approaches into a Peer-to-Peer Content Delivery Network (PCDN):
CDN provides the reliable, high-quality backbone infrastructure
P2P supplements it by allowing users to share content directly with neighbors
When the main CDN server gets overloaded, users automatically switch to nearby P2P peers to continue downloading without interruption.
4. ResourceCache Optimized Algorithm (Algorithm 1) The paper's custom algorithm for managing what gets stored in the cache and when to switch between CDN and P2P networks:
Monitors current resource consumption (CPU, memory, bandwidth)
Estimates how much resource will be needed in the next moment
Computes a "penalty vector" — a mathematical score representing the cost of the current caching state
When resource consumption grows too high, automatically switches the user to a P2P peer network
Goal: minimize time delay (target page load time ≈ 0.5 seconds)
5. Statistical Analysis for Time Delay Management Used to measure and manage how fast content is delivered. Methods include:
Descriptive statistics — understanding average load times
Hypothesis testing — verifying whether performance meets targets
Regression analysis — predicting future load times based on current trends
Time series analysis — tracking performance patterns over time
Bayesian analysis — updating predictions as new data arrives
6. Navigation Timing API A web technology used to measure actual page load speeds in real time, giving the system accurate data on whether the 0.5-second target is being met.
📺 STAGE 2 — SELECTIVE DESTINATION BITRATE-ADAPTIVITY (ADAPTIVE BITRATE STREAMING)
This is the stage that differentiates authorized from unauthorized users and adjusts video quality accordingly.
7. Adaptive Bitrate Streaming (ABS) ABS is the core technology that makes video streaming smooth regardless of your internet speed. Instead of sending one fixed-quality video file, the system:
Encodes the video at multiple quality levels simultaneously (low, medium, high, ultra)
Segments the video into small chunks (a few seconds each) rather than one large file
Continuously monitors the viewer's network speed and device capability
Automatically switches between quality levels in real time — stepping up when connection is good, stepping down when it deteriorates
Bitrate quality levels available:
128–160 Kbps → Low quality
192 Kbps → Medium quality
256 Kbps → High quality
320 Kbps → Highest quality
8. Digital Rights Management (DRM) A security technology that protects OTT video content from unauthorized copying, distribution, and access. DRM uses encryption and licensing to control who can watch what and on which devices. OTT platforms use DRM to prevent hackers from recording streams or accessing content without payment.
9. Device Authentication via Unique Device ID (IMEI) When a user registers for an OTT service, they provide:
Username and password
Unique device ID (e.g., IMEI number for phones — the International Mobile Equipment Identity)
Every time the user logs in, the system checks:
Is the password correct?
Is the device ID the same as the registered device?
If both match → Authorized user → Receives high-quality bitrate based on their subscription plan
If device ID doesn't match → Unauthorized user → Automatically receives the lowest possible bitrate (very poor quality) to discourage unauthorized access without completely blocking them
10. Selective Destination Bitrate-Adaptivity Algorithm (Algorithms 2 and 3) The paper's custom algorithm that implements the above logic mathematically:
Takes video segmented into λ-second chunks as input
For each network connection and processor capability:
If connection is high-end → good quality experience
If connection is low-end → buffering on lower bitrate
While video is playing:
Continuously checks: Is network throughput > current bitrate? AND Is user authorized?
If both YES → automatically adapts to higher bitrate
If either NO → maintains low bitrate
Switches to peer network resources if needed
Key mathematical concepts:
Buffer tenancy — tracks how full the video buffer is at any moment. A full buffer means smooth playback; an empty buffer means freezing
Smoothing factor (τ) — adjusts how quickly the system responds to changing network conditions
Scaling factor (sfbuff) — prevents video stalls by maintaining the buffer above a minimum threshold
Target buffer level (buftar) — the ideal buffer size the system tries to maintain, calculated as the average of upper and lower buffer thresholds
🖥️ STAGE 3 — NETWORK FUNCTION VIRTUALIZATION (NFV) + MULTI-ACCESS EDGE DATACENTERS (MEC)
As user numbers grow into the millions, the system needs intelligent infrastructure management. This stage handles that.
11. Network Function Virtualization (NFV) Traditionally, network functions like routing, load balancing, and firewalls required expensive, dedicated physical hardware. NFV replaces this hardware with software running on virtual machines (VMs) — the same functions, but flexible, scalable, and much cheaper to manage.
Benefits:
Can spin up new virtual servers instantly when demand spikes
Can scale down automatically during low-traffic periods
Supports dynamic resource allocation without physical infrastructure changes
12. Multi-Access Edge Computing (MEC) MEC moves computing power from distant centralized data centers to the edge of the network — much closer to where the users actually are. This dramatically reduces the distance data travels, which reduces:
Latency (delay) — especially critical for live streaming
Network congestion — less traffic on the backbone network
Response time — users get faster service
MEC handles: storage, computing, and networking operations — all at the network edge.
13. Virtual Machine Instances (VMs) The system runs OTT services on virtual machines rather than dedicated physical servers. When more users connect, new VM instances are automatically created. When users disconnect, VM instances are shut down to save resources. This elastic scaling is managed automatically based on real-time demand.
14. QoE (Quality of Experience) Measurement QoE goes beyond raw technical performance metrics — it measures the experience from the user's perspective. The paper measures QoE using a formula that combines three key factors:
QoE Score = f(stall count × stall duration × buffer duration)
Where:
Stall count — how many times the video froze
Stall duration — how long each freeze lasted
Buffer duration — total time spent buffering
The lower these three values are, the better the QoE score.
15. QoE-Based Load Balancing (Algorithm 4) The paper's custom load balancing algorithm that prioritizes user satisfaction:
Monitors QoE scores across all user clusters
Distributes traffic so that users experiencing poor QoE get priority resources
Two load balancing methods used:
Random accessing load balancing — users randomly connect to available servers; assumes user count is always somewhat higher than current actual users to prevent overload
Several users load balancing — distributes load based on how many users each server is currently handling
When a server VM's capacity is maxed out, a new VM instance is created. When demand drops, VMs are shut down in a controlled "cool-down" session process.
16. Content-Based Routing A load balancing technique where traffic is directed based on the type of content being requested, not just random distribution. Video content, user profile data, and analytics requests each get routed appropriately.
17. IMEI-Based User Tracking Across Devices The system tracks which device each user account is authorized for. If a user tries to access from a different device (not registered), they're flagged as potentially unauthorized. Users can register multiple devices (phone, tablet, TV, laptop) but must provide each device's unique ID.
📋 STAGE 4 — REVIEW OF RECOMMENDER SYSTEM
The final stage collects user feedback and uses it to improve service quality — while also using it as another signal to identify unauthorized users.
18. Feedback Collection and Segmentation The system collects feedback through:
Direct written reviews
Star ratings
All feedback is then automatically split into two categories:
Positive feedback → tells the service provider what's working well, maintain these features
Negative feedback → identifies problems that need fixing
19. Authorized vs. Unauthorized Feedback Filtering Here's the clever part: before acting on any negative feedback, the system checks whether the reviewer is an authorized user:
Authorized user + negative feedback → Take it seriously, investigate and fix the problem
Authorized user + positive feedback → Maintain the current service level
Unauthorized user + any feedback → IGNORE IT completely
This is important because unauthorized users receive deliberately poor video quality — so their negative reviews about "bad quality" would be misleading and irrelevant. The system automatically filters these out.
20. Recommender System Algorithm (Algorithm 5) The algorithm merges user IDs with their feedback records, then:
Lists all authorized feedback (with file path, username, tag, positive/negative labels)
Lists all unauthorized feedback separately
For authorized negative feedback → system flags the issue for service improvement
For authorized positive feedback → system maintains current service standards
For unauthorized feedback → all feedback is ignored regardless of content
📊 Performance Results
The system was tested and achieved the following results:
Unethical User Prediction Performance: Metric Score Overall behavior prediction accuracy 76% Average Precision 67.8% (at 500 users) Average Recall 74.2% (at 1000 users) Average F1-Measure 85.9% (at 2000 users)
These metrics mean:
Precision (67.8%) — of all users flagged as unauthorized, 67.8% were actually unauthorized (low false alarm rate)
Recall (74.2%) — of all actual unauthorized users, 74.2% were successfully caught
F1-Measure (85.9%) — the overall balance between precision and recall is strong, especially at higher user volumes
Bitrate Adaptive Performance: The system successfully scaled video bitrate from 500 mbits/s to 2,750 mbits/s over 2.44 seconds as network conditions improved — demonstrating smooth, real-time quality adaptation.
QoE Comparison (CDN vs OTT Video Content): Service Type Predicted QoE PR VoIP 2 ST VoIP 3.45 PR Video 4.78 ST Video 5
The CDN-based approach consistently provides better quality of experience for video streaming and VoIP compared to direct OTT delivery alone.
Network Latency (NFV-MEC): As user numbers scaled from 1,000 to 8,250, network latency increased from 3.34 ms to 24.58 ms — showing the system scales predictably, with CDN consistently achieving lower latency than raw OTT video content delivery.
🔐 Security Approach for Unauthorized Users
The paper uses a multi-layer security strategy rather than simply blocking unauthorized users: Security Layer What It Does Device ID verification Checks if the accessing device matches the registered device Password + ID authentication Standard login credential check Bitrate throttling Unauthorized users get lowest possible quality instead of being blocked outright DRM encryption Protects content from being copied or redistributed Multi-factor authentication Recommended as additional security layer Login attempt limiting Prevents brute-force password attacks Feedback filtering Ignores reviews from unauthorized users
The strategy of giving unauthorized users very low quality rather than blocking them entirely is intentional — it degrades their experience enough to discourage continued unauthorized use while making detection less obvious.
⚠️ Limitations Acknowledged
The paper honestly identifies several limitations:
Ethical concerns — monitoring and restricting users raises privacy questions
Sample size — testing with limited user counts may not fully reflect real-world scale
Bias — the model may be biased toward certain user behavior patterns
Changing user behavior — as users adapt to detection, their behavior may change in ways that defeat the system
Lack of context — the system may misidentify legitimate edge cases as unauthorized use
✅ Conclusion
This paper proposes a comprehensive four-stage technical system for OTT platforms that simultaneously:
Delivers content efficiently at scale using PCDN combining CDN and P2P networks
Rewards authorized users with high video quality and penalizes unauthorized users with low quality through adaptive bitrate streaming
Manages millions of users efficiently using NFV and MEC edge computing with QoE-based load balancing
Collects and acts on user feedback intelligently, filtering out misleading reviews from unauthorized users
The system achieves 76% behavior prediction accuracy and 85.9% F1-measure for unethical user detection, while providing measurably better quality of experience through CDN-based delivery compared to traditional OTT content delivery alone.












