Industria

Secure Real-time Transport Protocol (SRTP) provides end-to-end media confidentiality in Real-Time Communication (RTC) systems. However, since SRTP embeds application-specific semantics into its unencrypted headers and encrypts only the payload, this metadata remains observable—potentially enabling traffic analysis by passive adversaries even under encryption. We investigate whether plaintext SRTP header extensions can enable packet-level service classification in modern RTC deployments. We analyze six popular RTC applications and propose an ML-based classification pipeline that utilizes RTP header extension metadata to identify apps without any payload decryption, achieving a robust F1-macro score of 0.95. Furthermore, we propose and evaluate a lightweight, permutation-based countermeasure.