The distribution of videos over the Internet is drastically transforming how media is consumed and monetized. Content providers, such as media outlets and video subscription services, would like to ensure that their videos do not fail, start up quickly, and play without interruptions. In return for their investment in video stream quality, content providers expect less viewer abandonment, more viewer engagement, and a greater fraction of repeat viewers, resulting in greater revenues. The key question for a content provider or a content delivery network (CDN) is whether and to what extent changes in video quality can cause changes in viewer behavior. Our work is the first to establish a causal relationship between video quality and viewer behavior, taking a step beyond purely correlational studies. To establish causality, we use Quasi-Experimental Designs, a novel technique adapted from the medical and social sciences. We study the impact of video stream quality on viewer behavior in a scientific data-driven manner by using extensive traces from Akamai's streaming network that include 23 million views from 6.7 million unique viewers. We show that viewers start to abandon a video if it takes more than 2 s to start up, with each incremental delay of 1 s resulting in a 5.8% increase in the abandonment rate. Furthermore, we show that a moderate amount of interruptions can decrease the average play time of a viewer by a significant amount. A viewer who experiences a rebuffer delay equal to 1% of the video duration plays 5% less of the video in comparison to a similar viewer who experienced no rebuffering. Finally, we show that a viewer who experienced failure is 2.32% less likely to revisit the same site within a week than a similar viewer who did not experience a failure.Index Terms-Causal inference, Internet content delivery, multimedia, quasi-experimental design, streaming video, user behavior, video quality.

Online video is the killer application of the Internet. Videos are expected to constitute more than 85% of the tra c on the consumer Internet within the next few years. However, a vexing problem for video providers is how to monetize their online videos. A popular monetization model pursued by many major video providers is inserting ads that play in-stream with the video that is being watched. Our work represents the first rigorous scientific study of the key factors that determine the e↵ectiveness of video ads as measured by their completion and abandonment rates. We collect and analyze a large set of anonymized traces from Akamai's video delivery network consisting of about 65 million unique viewers watching 362 million videos and 257 million ads from 33 video providers around the world. Using novel quasi-experimental techniques, we show that an ad is 18.1% more likely to complete when placed as a mid-roll than as a pre-roll, and 14.3% more likely to complete when placed as pre-roll than as a post-roll. Next, we show that completion rate of an ad decreases with increasing ad length. A 15-second ad is 2.9% more likely to complete than a 20-second ad, which in turn is 3.9% more likely to complete than a 30-second ad. Further, we show the ad completion rate is influenced by the video in which the ad is placed. An ad placed in long-form videos such as movies and TV episodes is 4.2% more likely to complete than the same ad placed in short-form video such as news clips. Finally, we show that about one-third of the viewers who abandon leave in the first quarter of the ad, while about two-thirds leave at the halfway point in the ad.Our work represents a first step towards scientifically understanding video ads and viewer behavior. Such understanding is crucial for the long-term viability of online videos and the future evolution of the Internet.

No abstract

The domain name system plays a vital role in the dependability and security of modern network. Unfortunately, it has also been widely misused for nefarious activities. Recently, attackers have turned their attention to the use of algorithmically generated domain names (AGDs) in an effort to circumvent network defenses. However, because such domain names are increasingly being used in benign applications, this transition has significant implications for techniques that classify AGDs based solely on the format of a domain name. To highlight the challenges they face, we examine contemporary approaches and demonstrate their limitations. We address these shortcomings by proposing an online form of sequential hypothesis testing that classifies clients based solely on the non-existent (NX) responses they elicit. Our evaluations on real-world data show that we outperform existing approaches, and for the vast majority of cases, we detect malware before they are able to successfully rendezvous with their command and control centers.

An increasingly popular technique for decreasing user-perceived latency while browsing the Web is to optimistically pre-resolve (or prefetch) domain name resolutions. In this paper, we present a large-scale evaluation of this practice using data collected over the span of several months, and show that it leads to noticeable increases in load on name servers-with questionable caching benefits. Furthermore, to assess the impact that prefetching can have on the deployment of security extensions to DNS (DNSSEC), we use a custom-built cache simulator to perform trace-based simulations using millions of DNS requests and responses collected campuswide. We also show that the adoption of domain name prefetching raises privacy issues. Specifically, we examine how prefetching amplifies information disclosure attacks to the point where it is possible to infer the context of searches issued by clients.