Temporal patterns and security of SRT streaming protocol analyzed over 96 days
Temporal Dynamics and Security Assessment of SRT Protocol: A 96-Day Longitudinal Analysis of Production Streaming Infrastructure
Cryptography and SecurityMultimedia
Summary
This paper looks at how the Secure Reliable Transport (SRT) protocol behaves over a long period in a real streaming setup between Iraq and Turkey. The authors found that certain message types change a lot with time but only explain a small part of overall variation. They also tested attacks that flood the network and saw that while system resources like CPU usage spiked, the streaming protocol managed to keep data delivery mostly stable. Finally, their method detected real security issues better than simple fixed rules. This helps in planning system capacity and protecting streaming networks.
What this means in practice
- •For network operators: Optimize resource allocation and detect security threats in live SRT streaming deployments by monitoring CPU and protocol metrics over time.
- •For cybersecurity teams: Use multi-metric anomaly detection methods to distinguish between normal and attack traffic in streaming networks using SRT.
Authors
Ahmed F. K. Koysha, Ferdi Sönmez
Abstract
This study presents a 96-day longitudinal analysis of Secure Reliable Transport (SRT) protocol behavior in a production streaming environment between Iraq and Turkey, examining 262,672 transport metric samples and 5,033,104 system resource measurements collected between October 2025 and January 2026. The research addresses temporal patterns, system-resource relationships, attack vulnerability, and anomaly detection. Results reveal significant temporal variation: Negative Acknowledgment exhibits 7.6-fold hourly variation and 11.5-fold daily variation (p < 0.001), though with small effect sizes (eta^2 < 0.04), indicating that temporal period explains less than 4 percent of total variance. Central Processing Unit (CPU) utilization emerges as the strongest system-level correlate of transport variation (r = 0.617 with NAK rate). Controlled User Datagram Protocol (UDP) flood experiments at 500 packets per second cause CPU increases of 176 to 806 percent, while SRT transport metrics change by only plus or minus 13 percent demonstrating protocol resilience through the Automatic Repeat Request mechanism. An unexpected anomaly reaching 97.7 percent CPU enabled signature-based differentiation between attack types. A Z-score anomaly detection method outperforms fixed thresholds, detecting all 7 security events. This study contributes the longest temporal characterization of SRT metrics reported to date, the first system-SRT correlation analysis, and the first controlled security assessment of SRT infrastructure. These findings provide actionable guidance for capacity planning, security hardening, and multi-metric monitoring of production SRT deployments.