Generic / not censor-specific

A MESA Lab monthly report describes a 'web-proxy' engineering task that modified the open-source Ultraviolet web-proxy project to add keyword- and specific-URL-blocking, alongside deployment work (certificate issuance, redirect handling) and a document listing which sites the proxy is permitted to relay; the purpose (internal filtered access vs. a broader capability) is not stated in this excerpt.

TSG/CM ships with pre-built, first-class 'Learning Object' entries specifically for Freegate (Object ID 18) and Psiphon3 (Object ID 19), plus a generic 'Top Server IP' object (ID 20) -- default product features, not customer-commissioned custom signatures. The Psiphon3 object auto-learns and dynamically updates a live blocklist that reached roughly 70,000 IPs at one deployment before a database issue temporarily dropped it to ~50,000.

Crash-dump stack traces reveal TSG's core packet-processing engine (sapp) architecture: a custom multi-threaded C engine using 'marsio' as the DPDK-style packet-I/O driver, a plugin system for protocol handlers (confirmed: plug/protocol/http/http.so), and a libdocumentanalyze component that actively decompresses gzip content and parses ZIP/document formats found inside HTTP bodies -- i.e. inspection goes beyond headers into reconstructed application content.

An internal MESA Lab research survey ("审查规避调研报告") catalogs current academic circumvention research the lab tracks as detection R&D input: Geneva/GET-out packet-mutation evasion, the WebRTC-based Protozoa tunnel, and CDN-based domain shadowing combined with domain fronting -- evidence the lab actively monitors the circumvention literature rather than working purely from first principles.

certstore's own commit history documents its transparent-TLS-MITM mechanics directly: it writes the client's observed SNI into the SAN field of the leaf certificate it mints on the fly, supports ECC issuance (secp192r1/secp256r1) for those forged certs, and reads its Trusted/Untrusted decryption-keyring configuration from MAAT's DECRYPTION_KEYRING table -- confirming the interception pipeline end-to-end: client SNI in, matching forged certificate out, gated by MAAT-synced keyring policy.

Geedge runs an explicit, named signature-extraction program specifically targeting circumvention tools — Freegate, Psiphon, Ultrasurf, and Tor Browser (by package name: com.golden.freegate, com.psiphon3.subscription, us.ultrasurf.mobile.ultrasurf, org.torproject.torbrowser) — across Android/iOS/Windows, with weekly signature updates, for a site internally called 'K project'.

TSG implements heuristic tunnel-protocol detection distinguishing Teredo (IPv6-over-UDP, default port 3544) from GTP tunneling based on UDP payload inspection, used to decide 'innermost' session attribution for firewall matching.

"realtime_protection" (EnderByEndera/realtime_protection) is a Spring Boot "指挥系统" (command-and-control system) that generates dynamic/static blocking rules and DDoS-mitigation commands as tasks dispatched to multiple field sites ("局点"), tracking per-site command status, whitelist hits, and full command history — architecture consistent with centralized, auditable enforcement-command dispatch across TSG deployments rather than a single-site tool.

The zhuyujia/diamondv repo (branch "DoH_Scan") documents at least four rounds of systematic DoH-resolver and recursive-DNS-server discovery scans by IIE/MESA-Lab-affiliated researchers, with a companion DNS-probing tool (modikai/dtool: cache/rdns/record probers) and a commit explicitly labeled "upload corresponding egress servers", indicating the same effort also catalogs discovered egress/exit-node infrastructure alongside DNS-resolver reconnaissance.

A 2020 MESA Lab monthly report describes building an encrypted-DNS gateway device and a self-hosted DoH server that was wired directly into a live "TSG platform WAN net interface", alongside a passive DoH-service-discovery pipeline that found 39 new DoH-serving domains in a single day of backbone ("科技网") traffic; a related note documents actively probing known DoH-serving IPs' upstream resolvers via a proxy network across 196 countries to check which still function.

A 2024 MESA-team-supervised MS thesis ("面向DPI中间件的探测行为检测关键技术研究") builds detection of both measurement-oriented and evasion-oriented probing directed AT DPI middleboxes, using source-IP statistical features, with the stated goal of reducing the middlebox's resource consumption/exposure of characteristics under such probing and preventing DPI-middlebox function failure -- i.e., defensive hardening against exactly the class of academic censorship-measurement and evasion-search techniques (Censored Planet/GFWatch-style probing, Geneva-style automated evasion discovery) cataloged in this lab's own literature survey (see 2026-mesa-censorship-research-survey-f8c349).

The same MESA team overview describes a global "cyberspace mapping" active-reconnaissance platform built on rented distributed cloud nodes worldwide as a rotating probe/proxy pool (unreachable nodes replaced on an ongoing basis), plus an AI-driven (OCR + image recognition) UI-automation framework that can drive Android/iOS apps and web systems from natural-language test scripts for large-scale automated probing and data collection.

A June 2021 internal report measures a live in-network TLS-interception pilot: one sapp instance ingests raw ciphertext via mrzcpd while a second ingests plaintext from a "third-party decryption platform" over a Unix domain socket, and one hour of production traffic on a live front-end (10.187.0.2) shows the decryption platform successfully produced plaintext for 4.85% of raw traffic bytes and 7.4% of all port-443 TCP connections, with an average end-to-end decrypt latency of 1741ms (median 460ms, up to 6000ms) between first ciphertext byte and the resulting plaintext HTTP GET.

sapp's plugin API exposes explicit enforcement primitives -- MESA_kill_tcp()/MESA_rst_tcp() to inject a single RST, and MESA_set_stream_opt() with MSO_TCP_RST_REMEDY/MSO_DROP_STREAM to make RST-injection or packet-dropping persist for the remaining lifetime of a flow -- with a global sapp.toml auto_remedy toggle and a per-stream option controlling whether a lone RST is reinforced repeatedly for as long as the flow keeps sending data.

In sapp's inline deployment mode, packet injection is handled by a driver pair (mrzcpd + mrtunnat, an mrzcpd sub-component not previously catalogued) that must reconstruct per-link tunnel state (cached in /run/mrzcpd/mrmonit.tunnat) before forging a packet in the correct direction; the internal troubleshooting guide documents that injection silently fails for GTP/MPLS/GRE-tunneled flows when the reverse-direction tunnel identifier has never been observed on that link, an explicit "asymmetric address layer" edge case.

An internal "sapp" developer guide (marked "Geedge Networks Confidential And Proprietary") documents that MESA's core DPI/traffic-processing platform has gone through four generations since roughly 2005 -- start -> papp -> sappv3 -> sappv4 -- with sappv4 (introduced 2019) now the sole actively maintained branch, while some sappv3 deployments still run unless a critical bug forces an upgrade.

sapp's internal architecture guide documents three deployment topologies (mirror/passive-tap, inline, dual-arm transparent) and four distinct methods for injecting blocking packets back onto the wire, including a MAC-in-MAC scheme that extracts device/link IDs from mirrored traffic's source MAC field to route an injected packet to the correct physically separate inline device over VXLAN when multiple injection points exist.

An internal MESA literature-review report surveys published GFW-evasion research the team is tracking -- including Geneva-style TCB desynchronization, application-layer field-mutation evasion, CDN-based Domain Fronting/CacheBrowser/CDNReaper/Domain Shadowing/DfDs, and traffic-mimicry tools including the WebRTC-parasitizing tool Protozoa and the TLS-mimicking Trojan protocol -- indicating these specific circumvention technique families are on MESA's active R&D radar.

A production feature spec ("加密协议JG") requires detection-and-control capability for QUIC, ESNI, and ECH, with a per-connection log field c_encrypt_type explicitly distinguishing ClientHello encryption (0=unencrypted, 1=ESNI, 2=ECH) and a DF_QUIC_REGION rule table matching QUIC by SNI. The system computes a per-rule "CT" (穿透/penetration) rate from paired mirror-vs-functional RST-packet logs (TF-RST-LOG / TF-MIRROR-RST-LOG) to grade each block rule's effectiveness, and runs continuous active-verification probes against its own rules, deliberately varying the probe 4-tuple each run "to ensure it doesn't hit the blacklist" so the verification traffic itself reaches the target.

A published MESA Lab / IIE-CAS paper ("ExitSniffer", CCIS-2021) and two filed patents describe a tool that actively builds 2-hop Tor circuits through every exit relay to decoy websites and diffs the decoy's observed source IP against the relay's public consensus IP to expose non-public "hidden node" infrastructure behind Tor exits (96% coverage of all exits in about 50 seconds), plus a complementary passive method -- a government-funded ("国家信息安全项目") controlled Tor relay that logs real predecessor-hop IPs -- that found hidden nodes behind 71 of 6,850 tracked routing nodes; the same research program's dataset separately logs 10,412,582 real anonymous-user access records against 1,627,920 distinct clearnet domains visited through Tor.

An internal porting/test report documents migrating sapp and marsio (its DPDK-based packet-I/O layer) onto domestic Huawei Kunpeng ARM64 hardware (华鲲振宇 TG225 B1, dual KP920-5250 CPUs, 1TB RAM) running the Kylin (麒麟) domestic Linux distribution, using Huawei's Devkit source-migration scanning tool and DPDK 20.11.3 with hugepage/vfio-pci NIC binding, functionally validated via tcpreplay packet-injection tests.

An internal encrypted-DNS research report outlines a DoH-server discovery methodology combining public-list lookups, TLS-certificate-based active probing, and an ML-based hybrid active+passive detection method, feeding a global-vs-domestic-network DoH deployment mapping exercise that concludes with a "管控" (control/blocking) recommendations section; the extracted text preserves only section headers/outline, not the underlying methodological detail or numeric findings.

A Flink-based "FileChunkCombiner" pipeline in the TSG OLAP stack (galaxy/tsg_olap/file-chunk-combiner) reassembles file chunks parsed from proxy and session metadata (ParseProxyFileMetaFlatMapFunction, ParseSessionFileMetaFlatMapFunction) captured off monitored traffic, then persists whole reconstructed files to HBase and object storage (an "HosSink" and an OSS sink), confirming TSG performs full file-content extraction and durable storage from intercepted sessions, not just flow/metadata logging.

MESA Lab's internal "tcp_burst" traffic-replay tool (common_tools/tcp_burst, a fork of tcpreplay) bundles fragroute — a well-known IDS/DPI-evasion toolkit implementing TCP/IP fragmentation, segment reordering, chaffing, duplication, and delay — and integrates its replay path with the marsio packet-I/O framework also used by sapp, indicating fragroute-style evasion techniques are used internally to test TSG/sapp's DPI robustness against fragmentation- and reordering-based evasion.

Galaxy's platform-wide ClickHouse schema includes subscriber_id, RADIUS on/off, and RADIUS record-log fields as core session-log attributes (not a site-specific add-on), and a companion ArangoDB "knowledge" graph module (SubscriberIdProviderImpl / SubscriberIdPath) resolves subscriber-identity paths, while the platform's schema/API layer separately added KMS/Vault-backed decryption support for fields marked "encrypted, sensitive" -- showing subscriber-identity correlation and its at-rest encryption handling are built into the core multi-tenant analytics platform rather than bolted on per deployment.

The same TSG QA framework exercises live HTTP/HTTPS content-manipulation proxy actions -- redirect, replace, hijack, insert, and edit_element -- including a documented test case that adds a rule to replace "china"-related content in live Google search results, giving a concrete real-world target example for the platform's live content-injection/rewriting capability.

TSG's QA automation framework (dongxiaoyan/gap_tsg_api) documents the policy engine's app-blocking action taxonomy (default/Drop/RateLimit/Tamper, with "rst" later renamed "reset") and records that, as of a 2022 test-suite update, the circumvention tools Psiphon ("赛风") and Freegate ("自由门") were only supported under a RateLimit (throttle) deny action rather than a hard Drop, while dozens of other apps (WeChat, Telegram, WhatsApp, Tor, WireGuard, TachyonVPN, Instagram, Facebook, etc.) had named test coverage across Allow/Deny/Monitor actions.

TSG's blocking-policy validation API treats subscriber-identity fields (IMSI, phone number, APN, subscriber/sub ID) as first-class policy match/verification conditions rather than downstream-analytics-only fields, and the same QA suite includes test coverage for carrier-network tunneling and mobile-core protocols (GRE, GTP-C, SIP), indicating the DPI/policy engine is deployed inline within mobile-carrier network cores, not just fixed-line ISP links.

dongxiaoyan/gap_tsg_ui is a Robot-Framework QA automation suite for the TSG admin UI that validates a "Hijack Files" feature using uploaded test payloads of type .apk, .exe, .gif, .html, .jpeg, .png and .svg — confirming the live product can serve/substitute arbitrary file types, including Android APKs and Windows executables, as part of an intercepted-connection hijack action — alongside test cases for GTP-C records (mobile-core signaling) and first-class "subscriber_ids" and "mobile_identites" policy objects.

GEEDGE's own employee handbook gives a corporate timeline confirming: the company (中电积至(海南)信息技术有限公司 / Geedge Networks Ltd., founded July 2018 in Hainan) signed a strategic cooperation agreement with China National Electronics Import & Export Corp (中国电子进出口总公司 / CEIEC) in December 2018; obtained foreign-trade operating rights in May 2019; won an international competitive bid for its flagship TSG product against Canadian and Israeli competitors in June 2019; and completed phase-2/3 acceptance and delivery of an unnamed overseas project in January 2021.

A MESA thesis proposal ("移动互联网信令数据关联分析方法研究") builds a SAPP platform plugin that parses LTE GTP-C control-plane signaling (S11 interface) to extract session/TEID identifiers and correlate them with user-plane IP sessions, explicitly to resolve subscriber identity that is otherwise unavailable because "the data plane and signaling plane are separated" in mobile networks. A later revision of the same proposal confirms the parser and the ID-to-IP correlation logic are both implemented as SAPP plugins.

A TSG-OLAP Storm topology (galaxy/tsg_olap/relationship-gtpc-user, class GtpRelation.java) builds a live correlation table between GTP-C (mobile-carrier GPRS tunneling control-plane) tunnel identifiers/TEIDs and user sessions, streaming from Kafka into HBase — a mobile-network subscriber-correlation capability structurally analogous to the RADIUS-based correlation already documented under CyberNarrator's Pakistan deployment, but implemented as a general-purpose TSG-OLAP component rather than a single named/branded product.

A repo named "active-defense/houyi-deploy" is an Ansible playbook that installs a component called "houyi" (后羿) alongside sapp and a "wire-graft" packet-injection module (matching the taxonomy's marsio "wired_graft" plugin); the bundled RPMs/scripts include standalone binaries named tcp_syn_flood, udp_dns_flood, and a DNS-reflection-amplification script (reflect_dns.sh), indicating this TSG-adjacent platform includes offensive flooding/DDoS capability, not just passive blocking.

Two IIE graduate-research repos (cuiyiming/gradproj, a 2019-2020 master's thesis project citing NDSS'17 TLS-interception-measurement and TLS-client-identification papers; daxiaoxu/xmr_bsexpr2, a 2022 project with GRU-based sequence classifiers over TCP/DNS flow JSON and deleted docs on TLS1.3 and Tencent's proprietary MMTLS protocol) document the ML feature-engineering methodology (TLS certificate length, handshake message sequences, JA3-style statistics, Markov-chain packet-size/timing models, GRU sequence models) that plausibly underlies production classifiers (e.g. stellar's later JA4/JA4S support, MESA_sts's randomness checks).

A 2018-2019 IIE-authored repo (IPReuse/vpn_cgi) implements a Django CGI service ("VPN_CGI") with a Redis-backed IP-statistics module (stat_ip_redis.py), built by a team explicitly named "IPReuse" — early (pre-2020) tooling for tracking/managing VPN-associated IP addresses, structurally similar in purpose to the later-documented CyberNarrator 'vpn-thwarting' IP-harvesting/blocklist pipeline, though not confirmed to be the same lineage.

The IPReuse system implements SNAT/DNAT policy tables that classify subscriber sessions by a distinct "vpn" user type (separate from sipv4/sipv6), and exposes a dedicated "VPN_CGI" interface — indicating VPN traffic is identified and handled via its own NAT/IP-reuse policy path (architecture name "Flowood") distinct from ordinary subscriber traffic, with service IDs cross-referenced against the "PanGu" (盘古) system's own documentation.

TSG's AppSketch app-detection engine accepts custom Lua scripts for new signatures, feeding a client/server-role heuristic (lower port = server) for UDP policy matching; a custom OpenVPN-detection Lua script failed to trigger Deny specifically because that role-inference logic misclassified the flow's client/server sides.

Internal engineering docs detail MAAT's config/policy hierarchy (region/policy-unit -> group/policy-object -> compile/policy, a conjunctive-normal-form structure capped at 8 top-level groups), its Redis-backed one-master-many-replica config push ("MAAT Redis") with a rulescan fallback, and confirm MAAT runs non-distributed -- one instance per front-end traffic-scanning box -- invoked by sapp per-packet or per-stream (Maat_stream_scan_string_detail) with match-all-then-return semantics; recommended hardware is CentOS 7, 256GB RAM, 2TB disk, 48-core Xeon E5.

A 2024-05-17 MESA Lab / field-deployment engineering meeting documents MAAT's live rule-config pipeline in operational detail: a hard cap of 4096 hit results per query, incremental sequence-numbered config deltas reloaded on top of the last full snapshot, a documented "hit vacuum period" during config reload where partially-loaded rules silently fail to match, and separate JSON (test-only, small-scale) vs. Excel-tool-generated (production) config-authoring workflows.

The liuxueli/install-standalone-redis repo shows MAAT's Redis config-distribution backbone deployed as a 3-tier replication topology (redis-master, redis-global-slave, redis-global-slave-master) with dedicated systemd services and a MAAT_PRE_VER initialization variable, confirming Redis is provisioned specifically as MAAT's live rule-sync layer rather than as general-purpose caching.

A June 2024 MESA Lab internal survey ("针对审查系统的科学研究及探测技术调研报告") explicitly states its purpose is to catalog academic/public censorship-measurement and circumvention research (OONI, Augur, Satellite, GFWatch, Citizen Lab, CensorBib, FOCI/IMC/NDSS/CCS/USENIX Security papers) in order to find and patch GFW/censorship-system vulnerabilities before outside researchers exploit them. It systematically covers circumvention protocols/tools (Shadowsocks, VMess, Trojan, decoy routing, Parrot-style mimicry, CovertCast, Slitheen++, ESNI/ECH, uTLS) and notes GFW blocked ESNI (not ECH) since July 2020, plus historical TLS-fingerprint blocking of meek by a Cyberoam firewall (2016).

liuchang/mesa_sts packages the NIST SP800-22 statistical randomness test suite (frequency, block-frequency, cusum, discrete Fourier transform, linear complexity, longest-run-of-ones, (non)overlapping template matchings, poker, random excursions, rank, runs, serial, universal, approximate entropy) as "MESA_sts", exposed with a documented "randomlooking check" with per-test-function enable switches (branch feature-add_switch_for_randomlooking), and tested against captured WeChat voice-call (MMTLS) and Telegram MTProto (IPv4/IPv6, multiple key-negotiation variants) traffic — i.e. a production statistical-randomness classifier for identifying fully-encrypted/obfuscated protocol traffic.

An internal research document systematically profiles the domain/IP infrastructure, WHOIS/registration data, and captured traffic characteristics of three remote-access/VPN tools (Sunlogin/向日葵, TeamViewer, and OpenVPN over both TCP and UDP) as raw material for building app-identification detection signatures, following the same intro / user-scale / traffic-feature-analysis / packet-capture-and-naming structure per app -- consistent with the methodology described for Geedge's AppSketch signature-extraction pipeline.

The MAAT rule-engine's native C initialization API (MAAT_INIT_OPT enum) confirms Redis-backed live config sync (MAAT_OPT_REDIS_IP/PORT/INDEX, with a cumulative-update mode), matching the taxonomy's maat_redis_tool description, and exposes a MAAT_OPT_ACCEPT_TAGS mechanism for attaching arbitrary JSON metadata tags -- the documented example tags a deployment with a specific Beijing district location and an ISP name.

The user manual for a third-party network traffic-diversion appliance (NORMA1.7.3, vendor Beijing Hengguang Information Technology Co., Ltd, used as front-end capture/splitting hardware for a backbone/metro monitoring pipeline) describes native rule-matching and drop/forward actions keyed on subscriber IMSI/SUPI within telecom signaling-plane protocols (S1AP, Diameter, GTPv0-2, NGAP, SIP), plus an automated feature that correlates signaling-plane identifiers to user-plane traffic per subscriber and actively extracts that correlation for upstream delivery -- functionally adjacent to, but a distinct vendor component from, the CyberNarrator subscriber-correlation capability.

An internal sapp platform developer manual reveals sapp's full name ("Stream Analyse Process Platform") and documents a stream.tcp.inject.signature_enabled config option that embeds an identifiable pattern into TSG/sapp-injected TCP RST packets via the ip_id, ip_ttl, and tcp_win fields, explicitly so that RST packets originating from sapp can be verified with Wireshark or a standalone tool. The same section documents the platform's default RST-injection count ("first 3, then 1" per blocked connection).

TSG's core Kafka log producer (galaxy/tsg_olap/tsg_galaxy_producer) defines RADIUS_RECORD_LOG as a first-class log bean alongside CONNECTION_RECORD_LOG, PROXY_EVENT_LOG, and SECURITY_EVENT_LOG -- confirming RADIUS-based subscriber data ingestion is built into TSG's general-purpose analytics pipeline, not just the Pakistan-specific CyberNarrator identity-correlation add-on.

TSG's v2.0 real-time analytics stack (Kafka to Storm to Druid to ClickHouse, galaxy/galaxy-integration, hosted at git.mesalab.cn) defines a dedicated sessionInterceptHitsLog Druid ingestion job alongside policyEventLog, per-user topUserLog/topWebsiteDomainLog/topUrlsLog reports, and RADIUS/session-record 'completion' pipelines -- showing individual blocked-session events and per-user browsing destinations are logged and aggregated together with subscriber identity in one OLAP store.

TSG's official automated regression-test suite (dongxiaoyan/autotest_tsg, Robot Framework) includes a dedicated case named AllFlowHTTPSIntercept-001.robot under tsg_adc, alongside tsg-bifang API/policy-object test keywords -- confirming HTTPS/TLS interception is a first-class, explicitly QA'd feature path in TSG rather than an incidental byproduct.

IPReuse/mgw is a C++ NAT gateway (DNAT/SNAT) built by an IIE engineer that includes a vpn_monitor module which periodically polls a VPN server to resolve the current IP-to-user mapping, and integrates directly with the MAAT rule engine via a maat_redis handle (test_maat_redis.cpp, vendored maat-v2.3.3.tar.gz) — an early (2018) implementation of tying network-layer IP addresses to individual VPN user identity for policy purposes.

TSG's data plane runs as containers (firewall, packet-io-engine, proxy, sce, shaping) per TSGX appliance, built on an internal packet framework called Marsio/MRZCPD (config at /opt/tsg/mrzcpd/etc/mrglobal.conf), deployed with 32GB hugepages and tunable TX rate-limiting per bonded NIC.

An official "Geedge Networks Confidential And Proprietary" sapp/mrzcpd operations manual documents the packet-injection API (MESA_kill_tcp / MESA_inject_pkt) used for both out-of-band mirror-tap RST injection (relies on the local box's own IP routing table to send) and inline in-path injection (requires mrtunnat.conf tunnel-tracking state -- use_recent_tunnel, use_link_info_table -- keyed on outer/inner MAC and link_id/link_dir), plus the Marsio DPDK-based driver's I/O sub-modes (marsio4, marsio_vxlan, pag_marsio, agent_smith) and its role extracting VXLAN/GTP encapsulation metadata and stamping link/circuit identifiers into mirrored packets' MAC field for session-log correlation.

A MESA research-log entry details a NAT/shared-connection identification methodology combining TCP/IP fingerprinting (IP-ID, TTL, DF, window size, MSS, TCP-option ordering -- p0f-style), HTTP User-Agent diversity, TLS/SSL JA3 fingerprint diversity, and traffic statistical features (concurrent-TCP-connection count, idle-time jitter, upstream/downstream ratio stability, DNS query frequency) per endpoint over rolling time windows, with detection methods spanning direct UA inspection, threshold statistics, ML classifiers (random forest/SVM), and per-window entropy jumps across the fingerprint features.

An internal, '内部资料 注意保密'-classified architecture-group ('架构组') research report systematically profiles many third-party OA (office-collaboration) software products, extracting per-product app-identification features -- port-usage ranking, URL patterns, favicons, trademarks, page titles, HTML structure -- plus dedicated Android/Windows client packet-capture sections and a documented packet-data storage scheme, consistent with app-ID signature engineering (AppSketch-adjacent work) rather than the market-research framing of the report's own title.

MESA Lab maintains a dedicated "obfs4验证" (obfs4 verification) tool repo (wangmeiqi/obfs4_verify) containing Go and Python obfs4-handshake test/verify scripts plus a bundled pyelligator (Elligator2) implementation — the elliptic-curve-point-indistinguishability library obfs4 itself relies on for its uniform-random handshake — indicating active work to validate, detect, or replicate Tor's obfs4 pluggable-transport handshake.

handingkang/ohxmap is an internal MESA Lab build of the XMap-family Internet-scale scanner, with extensive IPv6 DNS probe-generation modules (module_dns6a/dns6ae/dns6af/dns6x etc.) and custom Redis output modules; it is maintained by the same author (韩丁康/HDK, [email protected]) responsible for the DoH/recursive-DNS discovery campaigns in the diamondv repo, corroborating an internal large-scale IPv6 address-space/DNS reconnaissance capability.

A confirmed bypass — TSG failed to extract SNI from TLS ClientHello when the SNI extension appeared later than expected in the extension list, letting those flows through unblocked (and incidentally TLS 1.3 flows generally, since clients fell back to 1.3 after 1.2 was blocked); fixed on-site via a patch to the "ssl.so" detection plugin.

A Deny policy using an SNI "Negate" condition fails to block after a page is refreshed multiple times, a duplicate of a prior known bug (TSG-18234) — indicating a reliability gap for negated-SNI-condition policies under repeated/retried connections.

TSG's appliance hardware line is branded 'TSG-X' running an OS layer called 'TSG-OS'; a performance-tuning ticket requests two TSG-X units built on dual-socket AMD Zen 4 64-core CPUs, indicating the current-generation hardware performance tier for large-scale deployments.

TSG runs two separate detection engines: a licensed third-party DPI engine for general app/protocol identification (requires per-environment authorization -- absent in a demo environment caused a detection gap), and a Geedge-built component ('glimpse_detector') specifically for VPN protocol identification (WireGuard, OpenVPN). App-ID numbering (e.g. built-in wireguard=3700) can be silently shadowed by environment-specific custom IDs, causing detection to fail even when the underlying protocol is correctly classified.

A crash/perf bug report reveals Geedge's MAAT rule engine (libmaatframe.so, using Intel Hyperscan for literal/regex matching) running with 545,441 FQDN blocking rules and 404,141 IP address blocking rules loaded in a single instance as of 2024; loading 500,000 new FQDN rules via the full Hyperscan path took ~95 minutes, addressed by an automatic fallback to a second engine ("Rulescan") above 50,000 rules.

Geedge ran a live demo for a visiting delegation at its Yizhuang (Beijing) facility specifically showcasing Psiphon3 blocking, alongside a CN console walkthrough — evidence Psiphon-blocking is used as a sales/prospect differentiator, not just a defensive feature.

During QuarkVPN feature extraction, Geedge found client/server roles over UDP distinguishable by port-number heuristic (server's fixed ports 59001/59002/60000 exceed the client's random port), though this heuristic is currently causing misidentification, filed as an open bug.

TSG's 'APP' classification feature has named, purpose-built signatures for specific circumvention tools — the ticket explicitly configures active-client-IP tracking for the APP categories Freegate, Psiphon3, and Tor.

As of TSG's SSL/protocol parser in 2022, in-band STARTTLS negotiation (observed via XMPP) was not supported by the SSL parsing logic, causing app-identification-based blocking to silently fail for STARTTLS-negotiated sessions; the workaround was a manual TCP-payload string match rather than proper protocol classification. Confirm current status before relying on this -- single 2022-dated ticket, may since be patched.

TSG supports a LUA-scriptable plugin that, when traffic matches a proxy-policy condition, injects a user-supplied HTML response back to the client (C2S direction), with template placeholders for live substitution of timestamp, content-length, a per-hit random token, and a configurable redirect URL.

TSG has a configurable, policy-driven TLS interception (MITM) engine (service: certstore) with per-connection 'Trusted'/'Untrusted' certificate profiles, a certificate-pinning-detection classification ('Pinning' vs 'Not Pinning'), and a Dynamic Bypass toggle, tested against *.badssl.com as of TSG 22.11/22.12.

Geedge extracted and analyzed Betternet VPN's underlying protocols (WireGuard, a proprietary "Hydra" protocol using spoofed-domain TLS 1.2, and IKEv2), and found the Hydra protocol could be "completely blocked" via JA3 TLS fingerprinting; IKEv2 was blocked via UDP port 500/4500 policy, and thousands of VPN server IPs were extracted as a supplementary IP blocklist.

Geedge extracted ProtonVPN server IPs using the app's own debug-log output to find its server-list API endpoint, directly querying it to harvest ~5,800 server IPs, then used automated repeated connection cycling to extract ~200 additional rotating IPs after the initial list was blocked; the app was subsequently reported fully blocked on Android, iOS, and Windows.

Geedge fingerprinted several V2Ray-based VPN apps by their fixed API/bootstrap domains rather than protocol characteristics — blocking "V2 Pro" via pro.mucacherry.org, "V2 VPN" via v2.mucacherry.org, and "V2Net VPN" via api.v2net.live plus 5 rotating free-node domains (free1-5.v2n3t2.online / v2n3t.online) the app uses to fetch node lists.

PanGu's multimedia business schema defines dedicated service IDs for blocking AND monitoring based on speaker (voice) recognition, TV/radio station-logo ('台标') recognition, and face recognition (initially 0x10B-0x10D block / 0x18B-0x18D monitor as of Sept 2018, renumbered to 0x10C-0x10E / 0x18C-0x18E later that month) -- i.e. biometric/media-content classification is a native, named blocking capability in TSG's core policy engine, not just protocol/keyword/domain matching.

TSG's core policy-database spec (internal codename 'PanGu') formally defines proxy-layer 'Insert' and 'hijack' manipulation actions with configurable target IP/URL and, from May 2019, response-header fields -- plus a separate 'IP address impersonation' proxy service (business ID 0x206, PXY_INTERCEPT_IP) backed by a spoofing address pool (PXY_OBJ_SPOOFING_IP_POOL) -- i.e. HTTP response injection/hijacking and IP-level spoofing are named, first-class business rules in the schema underlying every TSG deployment, not ad hoc capabilities.

PanGu defines a configurable DNS response-spoofing subsystem (NTC_DNS_FAKE_IP_CB, NTC_DNS_RES_STRATEGY) supporting named 'answer groups' with a configurable number of fake answers returned per group (service ID 0x40 'dns欺骗'), i.e. DNS injection is a general, group-configurable policy primitive in TSG rather than a single hardcoded fake-IP response.

PanGu/ntc_http_collect is an HTTP-traffic collection tool (part of the broader "PanGu" / 盘古 system referenced elsewhere in this corpus) that extracts URL, referer, and packet-capture-machine IP from monitored HTTP sessions, applies a rule list (conf/http_url_filter.conf), and publishes to Kafka for downstream MESA/TSG processing.

PanGu defines explicit business/service IDs for webpage keyword blocking (0x28) and keyword monitoring (0x98), with a dedicated NTC_KEYWORDS_URL_LOG log table storing the URLs recovered from keyword-hit traffic -- confirming keyword-based content filtering is a named, first-class TSG business rule with its own audit log, separate from domain/IP/SNI blocking.

TSG's SSL/IPD logging schema records a hit_pos field on every SSL-blocking log entry (NTC_SSL_LOG, IPD_SSL_IP_LOG) whose value is explicitly one of SNI, SAN, or CN -- confirming TSG's TLS-blocking decision can be attributed to, and therefore driven by, the certificate's SAN or CN fields, not only the ClientHello SNI extension.

A repo under a "PanGu" (盘古) namespace, "t2httpcontentscanner" (component T2_HTTP_DIG_BIZ, i.e. an HTTP-layer inspection/scanning business module), bundles an HTTP content-scanning DPI plugin together with a packet-injection header (stream_inject.h); its final 2019 commit updates both a third-party "丁牛" (Dingniu) dynamic library dependency and a "主动测试脚本" (active-probing/active-test script), indicating active-probing tooling shipped alongside this HTTP scanning+injection module. This appears to be a separate or predecessor DPI line from the sapp/MAAT stack documented elsewhere in this corpus.

The PanGu/pangu_valve repo implements MAAT's live blocking/throttling distribution layer: it consumes Redis-backed MAAT config tables (APP_DOMAIN, APP_POLICY, LIMIT_DOMAIN, APP_STATIC_SEV_IP, APP_DYN_SEV_IP_CB, LIMIT_DYN_IP_CB) and pushes reference-counted domain/IP block and rate-limit rules to inline ("串联设备") network devices, scoped per inline-device business ID.

PanGu documents a dynamic VOIP-blocking pipeline where a system named 'Eastwatch' generates four-tuple blocking rules from VOIP call-detail ('FD') logs, which are then pushed by the policy gateway ('阀门') to a downstream component named 'C3' (MM_DYN_VOIP_DROP table) -- two previously unseen internal component names in this corpus tied specifically to real-time VOIP call blocking.

A design document for "PDNS" specifies a recursive DNS resolver that dynamically monitors per-user behavior and applies differentiated blocking policy: NXDOMAIN or redirect-IP responses per target domain via BIND9 RPZ, a front-end "user reputation" score that adjusts per-user policy based on request history, and planned support for multiple ingress methods including encrypted DNS. The working prototype demonstrates source-IP-based user classification into block/passthru groups with policy synced via BIND9 zone transfer from a primary RPZ server.

A MESA Lab repo (daxiaoxu/xmr_bsexpr3) contains standalone detection/fingerprinting scripts specifically targeting QQ (Mobile and Windows clients) and WeChat, alongside a script named PSK_LifeTime.py, suggesting TLS session-resumption / PSK-ticket lifetime is being explored as a traffic-fingerprinting feature for identifying or tracking these apps' encrypted sessions.

2021 MESA meeting notes describe drafting a patent disclosure for "全透视内容在线解析" ("full-transparency online content parsing"), alongside "用户测绘" (user/asset mapping) work and a "整形平台" (reshaping platform) built on S3-compatible (minio) storage -- suggesting an online content-decryption/parsing capability under active IP filing, though the notes do not specify the underlying mechanism.

A MESA Lab researcher maintains a small repo explicitly named "quic-block" (LiFulian/quic-block) containing a single C++ source file "quic_lfl.cpp", indicating standalone development work on QUIC/HTTP-3 blocking logic; the repo's minimal size (5 files) and "studyGit" commit suggest early-stage or personal research rather than a shipped product module, so this should be read as evidence of active R&D interest rather than a confirmed deployed capability.

A TSG-OLAP Storm topology (galaxy/tsg_olap/storm/radius-account-knowledge, bolt class RadiusCleanBolt.java) cleans and streams carrier RADIUS accounting logs via Kafka as a standing, general-purpose TSG-OLAP pipeline component (with an EAL4/Common-Criteria-tagged build branch), structurally similar to — but broader than — the Pakistan-site CyberNarrator RADIUS/AAA subscriber-correlation engine already documented in this corpus.

The general-purpose TSG big-data pipeline (galaxy/tsg_olap/dynamic_complement) includes dedicated "FlumeRadiusOnOffInterceptor" and "FlumeSubscriberInterceptor" modules plus a standalone "用户名写入Hbase程序和上下线日志程序" (username-to-HBase-write and login/logout-log program) built against tickets TSG-1845/TSG-2020, showing RADIUS-based subscriber-identity correlation is wired into the general OLAP data pipeline used across deployments, not confined to the Pakistan-specific CyberNarrator subscriber-correlation module already documented.

The same feature spec adds a "定向攻击检测" (targeted-attack detection) mechanism: the front-end tracks per-rule (configID) hit counts against a threshold/interval, and once exceeded can throttle or fully suppress emission of RST/block packets and logs for that rule (action codes include "do not send block packets," "sample block packets") -- an explicit rate-limiting countermeasure against the operator's own RST-injection infrastructure being weaponized for reflection/availability attacks, the same attack class (Bock et al., "Weaponizing middleboxes"; "Your censor is my censor") cited in this same lab's own literature survey (see companion finding 2026-mesa-censorship-research-survey-f8c349).

MESA Lab meeting notes (Nov-Dec 2021) document development and a staged production rollout of a new sapp plugin that identifies encrypted video streams via "burst" (packet-timing/size-burst) traffic features designed to generalize across varying network conditions, trained with machine learning, with a first burst-rule version scheduled for live deployment and sapp modified to log additional features for continued training.

A June 2021 MESA Lab test report ("精管流量初步分析报告") measured a live TLS-decryption pipeline feeding two sapp instances -- sapp A ingesting raw encrypted traffic via mrzcpd, sapp B ingesting plaintext from a third-party decryption platform over a Unix domain socket -- and found decrypted plaintext covered only 4.85% of raw traffic bytes and 7.4% of port-443 connections, with average MITM decryption latency of 1741ms (range 158-6000ms) across 2957 matched connections.

A MESA engineer wrote a SAPP business-layer plugin (v1 shipped to GitLab) that fingerprints network scanning/probing tools, producing a "scanning/probing tool fingerprint-database construction report." The companion fingerprint report documents Nmap's default host-discovery probe sequence (ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, ICMP timestamp request) captured against a live target.

Commit history in the core sapp DPI engine repo (MESA_Platform/sapp) shows its RST-style blocking/injection path is internally called "欺骗包" (literally "deceptive/spoofed packet") injection, implemented via a sapp_inject_ctrl_pkt function that sends forged control packets to all devices opened through the marsio packet-I/O layer; ticket TSG-20317 documents active, ongoing optimization of "inject packet duplicate traffic detection" performance in this code path as of 2024.

The stellar/stellar-dev-env repo pins a paired release of sapp-4.3.38 with a companion component "stellar-c-1.0.13", built via an internal RPM repo hostname (el8.repo.internal.geedge.net.repo) and a "tsg_framework.sh" bootstrap script — evidence of a previously undocumented internal component ("stellar-c") versioned alongside sapp and an internal geedge.net package-repo infrastructure supporting TSG-OS builds.

MESA Lab / IIE-CAS research (patent application no. 202410203156.3, "一种基于主动探测的Tor桥节点的隐藏节点发现方法及系统") built automated active-probing tooling that discovered 44 "ShadowBridge" instances and 71 hidden real-IP nodes behind public Tor bridges over a 3-month run, finding this hidden-node churn increased the count of ASes able to eavesdrop on bridge traffic by roughly 30.8%; the same effort built an automated bridge-collection pipeline (proxied Gmail-based bridge requests plus manual enumeration, ~8000 bridge addresses collected) and a private Tor test range including private obfs4 and meek bridge deployments.

Signal's built-in censorship-evasion feature routed traffic through Google infrastructure (SNIs clients3/4.google.com, inbox.google.com, android.clients.google.com), fully bypassing a TSG Deny policy as of July 2024 for messaging/file transfer (voice/video still failed).

A sapp-based "single flow aggregation" module's header dependencies (Maat_command.h, Maat_rule.h alongside stream_inject.h and sapp_inject.h, plus wiredLB.h/wired_cfg.h) show sapp's Maat rule-matching engine and its packet/stream-injection subsystem share a common internal API surface within the same MESA include tree, corroborating that a Maat rule hit can directly drive inline packet injection within one sapp pipeline instance.

Internal spec for "spacemap-service", a passive-DPI-fed reconnaissance database and web UI that catalogs every observed website's IP/domain, geolocation, ASN, DNS server, CDN vendor, TLS certificate fields (issuer/CN/SNI), OS and web-framework fingerprint (via Wappalyzer), and WHOIS/ICP registration data, exposing reverse-lookup search by any single attribute (e.g. all sites behind a given cert issuer, ASN, or CDN vendor).

"stellar" (stellar/stellar-2022) is a plugin-based protocol-decoder SDK (packet_io, plugin_manager, session_manager modules, with HTTP and DNS decoder components under active development through 2022) that runs on a "marsio mode" packet-I/O backend, showing the DPI decode layer beneath sapp is a modular framework supporting pluggable per-protocol decoders beyond SSL/TLS alone.

The "stellar" DNS decoder plugin parses complete DNS messages including all standard resource-record types plus DNSSEC records (DS, RRSIG, NSEC, DNSKEY, NSEC3, NSEC3PARAM), and exports every answer/authority/additional RR as JSON per DNS transaction via a dedicated exporter, along with a separate CNAME-chain-only JSON exporter. This is full-content DNS resolution logging infrastructure feeding the wider "stellar" inspection pipeline; no DNS injection/poisoning/answer-rewriting logic is present in these two files, only passive parse-and-export.

The "stellar" HTTP decoder plugin identifies HTTP CONNECT-method proxy tunnels (httpd_tunnel_identify) and, once a successful CONNECT response is observed, re-enters the payload as a nested HTTP stream (tracking tunnel_state transitions through session exdata) so that traffic carried inside an HTTP CONNECT tunnel continues to be parsed as HTTP rather than treated as opaque bytes — i.e. the DPI follows through simple HTTP-proxy tunneling rather than losing visibility at the CONNECT boundary.

A November 2024 commit to the stellar DPI engine's TLS decoder adds JA4 and JA4S TLS-handshake fingerprint calculation ("tls decoder support calculating JA4/JA4S fingerprint"), showing Geedge's core inspection engine has adopted the modern JA4/JA4S fingerprinting scheme (successor to JA3/JA3S) for client/server TLS fingerprinting as of late 2024.

A previously-undocumented sapp plugin named 'Stellar' (repo stellar/quic_decoder, packaged as stellar-on-sapp, depending on sapp-devel and OpenSSL) implements 'quic_deprotection' — QUIC packet-protection removal — as a component distinct from the older MESA_Platform/gquic plugin, sharing the same test corpus of GQUIC/IETF-QUIC pcaps (RFC9000, chlo-fragment, no-SNI cases). This is a candidate new product entry for the taxonomy: a second, apparently newer QUIC-inspection engine alongside gquic.

The "stellar" QUIC decoder plugin implements a complete RFC 9001 QUIC Initial-packet header- and payload-deprotection pipeline (HKDF key derivation from the well-known public IETF/gQUIC initial salts, AES-128-GCM payload decryption, AES-CTR header-protection removal) to decrypt QUIC ClientHello messages in real time, reassembling CRYPTO frames fragmented across multiple UDP datagrams, and extracts SNI and User-Agent from the decrypted handshake. It separately parses legacy Google QUIC (gQUIC) CHLO tag-value blobs (TAG_SNI / TAG_UAID) for older/non-IETF QUIC variants, and recognizes version ranges for a long list of QUIC implementations (mvfst, quant, quicly, msquic, mozquic, picoquic). A config flag (DECRYPTED_SWITCH) toggles whether the decrypt-and-inspect pass runs.

"stellar" (git.mesalab.cn / geedgenetworks.com) is a C++ core DPI packet-processing engine with protocol decoders (HTTP, FTP, mail, QUIC, RTP, SIP, DTLS, SSL, DNS, SOCKS, stratum) and a dedicated packet-injection module (src/stellar/inject.cpp) with an extensive TCP-RST-injection test suite covering injection timed after SYN, SYN-ACK, first C2S payload, and sub-ACK. It integrates the MAAT rule engine (security_enforcer.cpp / scanner_maat.c, "Security enforcer maat plugin table"), the Marsio packet-I/O framework (marsio_io.cpp), and glimpse_detector as an integrated decoder plugin ("integration glimpse_detector", "rename to lpi plugin").

A DPI session-plugin ("stellar" framework) SSL/TLS decoder fully parses live ClientHello/ServerHello handshakes, computing JA3/JA3S fingerprints (MD5 over version+cipher-suites+extensions with GREASE values stripped per the standard JA3 spec), extracting plaintext SNI, explicitly flagging whether a ClientHello carries ESNI (extension type 0xFFCE) or ECH (extension type 0xFE0D), and decoding full X.509 certificate chains (issuer/subject RDN sequences, SAN, validity window, serial, pubkey, signature algorithm) in real time. It also recognizes TLCP 1.0 (China's national "国密"/GmSSL TLS variant) as a distinct protocol version alongside SSLv2 through TLS1.3.

A June 2023 MESA engineering report on "TF项目" ("project TF") documents TSG configuration changes alongside CM and OLAP components, and explicitly records resolving a "hijack-injection function" (劫持注入功能) interface issue where policy was not taking effect, followed by completed hijack-effect verification and active-defense (主动防御) effect verification -- naming two further internal tools, netflood and houyi, used alongside sapp for packet injection, plus a git.mesalab.cn/active-defense repository.

MESA Lab operates an internal Tor "cyber range" (靶场) that builds and deploys custom Docker images running a modified Tor codebase across directory-authority, relay, guard, exit, client, and onion-service roles for hands-on experiments; this doc walks through forcing the deprecated Tor v2 onion-service protocol back on for a specific "v2 hidden service discovery" exercise.

chongming/traffic_replay is a Flask/tcpreplay-based QA harness that replays curated pcaps against a TSG instance to exercise its decoders, including SSL fixtures specifically named ssl_ech_false.pcap, ssl_no_sni.pcap and ssl_tls13.pcap alongside esni.pcap, openvpn.pcap, and major-platform captures (facebook/google/twitter/ youtube). A companion update_tsg_ca.py/tsg_ca.txt installs a TSG-issued CA cert on the test client, confirming the QA environment exercises TLS interception as part of routine detection testing.

A MESA Lab experiment re-identifies individual users across time solely from which domains they visit, using one-hot/frequency "domain access vectors" (Jaccard, overlap-coefficient, cosine, Euclidean) computed against real production HTTP logs pulled from a ClickHouse table named tsg_galaxy_v3.connection_record_log_http_domain. The best-performing configuration (Alexa top 100-10000 domain list, overlap coefficient) distinguished the same user's adjacent-hour sessions from other users' sessions with high separation (~0.19 vs ~0.88 average difference).

The galaxy/deployment/tsg-olap-data-initialization repo defines TSG's production big-data backend (ClickHouse/Druid/HBase/Kafka via "groot-stream" ETL) and includes a named multi-datacenter pipeline "pxy_exch_intermedia_cert_kafka_to_ndc_kafka" that streams proxy-exchange intermediate (MITM) certificates from a site datacenter to a "national datacenter" (ndc) Kafka cluster, alongside session/transaction/VOIP record and DOS-event pipelines with per-site vs. national-datacenter topology.

A TSG-Application blocklist test found that disabling Facebook/Twitter in TSG's per-app policy did not stop Psiphon3 traffic from reaching those services in practice, because Psiphon3's dual-stack fallback drove the tunneled Facebook traffic over IPv4 QUIC, which TSG's classifier failed to attribute to Facebook -- in contrast to Taobao/Bilibili/Youku/JD, which TSG blocked successfully in the same test.

tsg-ui/demo is a TSG v3.0 "Security Policy" UI prototype (logo file literally named "TIANGOU logo", confirming TSG's Tiangou naming origin) whose page inventory enumerates the product's full policy-object model: certificate management (keyrings, SSL-decryption exclusion, trusted CA authorities), policy objects including keyword (kw) and subscriber-ID (sid) categories and a "proxy manipulation policy" object, and per-profile "Hijack Files", "Insert Scripts", "Response Pages", and "Traffic Mirror Profiles / decrypted-traffic-forwarding" configuration screens.

TSG's automated QA suite (dongxiaoyan/tsg_autotest) includes an end-to-end test matrix for live HTTP/SSL content manipulation (Allow/Deny/Hijack/Insert/Replace/Redirect actions, both UI-driven and via curl scripts) and SSL interception, using a self-signed "mesalab-ca"/"tango-ca" root and intermediate CA chain with forged leaf certificates for real domains www.amazon.cn and www.bing.com, plus localized block/404 response-injection pages in Chinese, English, and Russian.

A Storm-based OLAP pipeline (galaxy/tsg_olap/storm/log-address-hbase) includes a dedicated "SubscriberIdBolt"/"SubcribeIdBolt" topology stage that writes RADIUS session data into HBase, alongside a subscriber-config.properties file. This is distinct infrastructure evidence (2018-2021) that TSG's big-data/OLAP layer, not just the CyberNarrator subsystem, ingests and persists RADIUS-derived subscriber identity data at scale.

Geedge runs an ongoing, largely manual weekly signature-extraction program against commercial VPN apps (LetsVPN, Betternet, VPNLITE, and a ~80-app batch), combining server-IP lists, FQDN patterns, and payload/SNI/Host/User-Agent signatures, tested for blocking efficacy and false-positive rate before rollout. VPNLITE was fingerprinted via TCP direct-connect on ports 18000/3320/8099 plus TLS to randomized .xyz/.info subdomains on Cloudflare ranges (104.21.0.0/16, 172.67.0.0/16).

Meeting notes from a MESA "VPN基础设施" (VPN infrastructure) project log explicit work sessions on "cloud services & CDN IP range" cataloging, "SS [Shadowsocks] experiments," and "Snowflake, SS organizing" across consecutive weeks in mid-2022, alongside a separately named "网络公害" ("internet nuisance/hazard") project.

A 2024 bachelor's thesis from UCAS, advised by a senior engineer at the Institute of Information Engineering (IIE), Chinese Academy of Sciences, built and evaluated a dynamic, iterative VPN-server identification prototype combining active-probing response features with passive traffic features and an IP-similarity graph-relationship model; the combined system reached 92.44% online-test identification accuracy (versus 87.19% accuracy / 86.38% F1 for the offline active-probing-only variant).

A Flink project internally named "flink-vpn-recommend" (galaxy/tsg_olap/app_recommend, package com.galaxy.recommend.Recommendation, class TopNHotItems) computes top-N "hot item" rankings from TSG OLAP traffic data; the project naming and Recommendation/TopN class structure suggest a VPN or app usage-ranking pipeline, plausibly used to prioritize which VPN services warrant new detection-signature development, though no explicit VPN-selection logic is visible in this metadata-only artifact.

"WebHopper" (zhuyujia/webhopper) is a website crawling/analysis pipeline combining a customized headless-Chromium build ("adg-linux"), a CA-certificate lookup module (caLookup.py), a DNS lookup module (dnsLookup.py), and EasyList-based ad-filtering (ATFilter.py) — infrastructure consistent with building or maintaining large-scale website classification/blocklist datasets that could feed FQDN rule sets like those used by Maat/AppSketch, though the artifact's metadata alone does not show the crawl output's downstream destination.

A URL/domain-classification service (yinjiangyi/webskt-query-agent) integrates the third-party BrightCloud (Webroot) URL-categorization API (BrightCloudUtils.java, brightcloud.properties, map_clf2brightcloud.csv) alongside its own reputation/whois lookups, suggesting TSG's category-based content policies (e.g. block-by-category) are informed by a licensed external URL-reputation database rather than purely in-house classification.

A MESA Lab research note dissects the Tor Project's webtunnel pluggable transport (HTTPT-based) and reports a hands-on pcap analysis of 3 public webtunnel bridges: the observed TLS ClientHello/cipher-suite fingerprint and SNI matched an ordinary HTTPS connection to the bridge's cover domain, with no certificate visible in the captured handshake -- i.e. these deployments withstood the lab's basic passive TLS-layer fingerprinting attempt at the time of writing.

wujiating/detection (by the same MESA Lab researcher behind wujiating/censorship_detection, a translated censorship-detection literature survey) is a CICFlowMeter-based ML traffic classifier trained on the public ISCX VPN-nonVPN dataset plus custom-captured DoH and generic web pcaps, organized into explicit closed-world (CW) and open-world (OW) evaluation splits — evidence of dedicated open-world DoH-traffic classification research at MESA Lab.

MESA Lab researchers built and iterated a Scapy-based website-fingerprinting classifier that identifies specific YouTube videos from encrypted traffic by matching the packet-size sequence of thumbnail-image requests (triggered on SNI yt3.googleusercontent.com / yt3.ggpht.com) against a pre-built reference dataset (dataset_24_youtube_fingerprints.csv), scoring candidate matches on sequence overlap and total-payload-size ratio against fixed thresholds (0.65 / 0.85).

A MESA researcher's status report lists work on encrypted-DNS-resolver role classification (ADNS/FDNS/RDNS) and DoH resolver component-chaining clustering, alongside a project named "YYDNS" (probing-system backend workflow and data integration) and a completed "ZX VPN active-probing requirement discussion" -- indicating a dedicated active-probing module was scoped against a specific named VPN product.