An IIE CAS thesis revision memo shows a student's research was retitled from "measuring evasion attacks against censorship middleboxes" to "evasion-attack traffic generation for DPI middleware" after committee feedback that "censorship middlebox" was too sensitive a term; the work builds evasion-generation tooling (citing Geneva's genetic-algorithm and SymTCP/Alembic's symbolic-execution approaches to TCP state desync) and explicitly tests it against "a specific country's DPI middleware" plus open-source DPI/NIDS, then derives defensive recommendations from the vulnerabilities it discovers.
修改说明：根据修改意见，原研究点一"面向审查中间件的规避攻击测量"修改为"面向DPI中间件的规避攻击流量生成"，其中包含规避攻击流量生成算法以及对应工具的实现，还有利用工具实现的特定的国家DPI中间件和开源DPI中间件的测试工作，最后分析得到DPI中间件的脆弱性，进一步给出防御建议。
Defense implications
- MESA-affiliated researchers are red-teaming DPI middleware (implicitly including state censorship infrastructure) with Geneva/SymTCP-style automated TCP-desync evasion generators and feeding results back as defensive patches — evasion techniques drawn from published academic literature (fragmentation, overlapping segments, TCB desync) should be assumed to have a shrinking, monitored lifespan against GFW-grade DPI rather than treated as durable circumvention primitives.
Related findings
An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.
A June 2024 IIE CAS master's thesis (author and advisor names redacted) built a genetic-algorithm + simulated-annealing evasion-traffic generator and, from Sept-Dec 2023, ran live tests against national government HTTP-censorship DPI middleboxes it labels 'RU,' 'KZ,' and 'IN,' plus open-source Snort2/3 and Suricata, cataloging per-target working evasion techniques (e.g. Host-header duplication and field-case manipulation defeat the RU target's Host-based filter; the IN target returns a ~1.2KB block page instead of dropping the connection) in a country-by-technique table, and benchmarked generation efficiency against the open-source 'Geneva' evasion tool from academic circumvention research. NOTE: neither 'ru' (Russia) nor 'in' (India) exists yet as a censor entry in this corpus's taxonomy -- flagged as new-censor candidates; 'kz' already maps to Kazakhstan, a confirmed TSG export site (K18).
The same 2024 IIE CAS thesis proposes 'PED' (Packet-context based Evasion Detection): an XGBoost flow-feature pre-filter followed by a GRU-based autoencoder trained on packet-context features (inter-packet plus protocol-layer, including HTTP-layer fields) that flags DPI-evasion traffic via reconstruction error, reporting accuracy/ROC-AUC above 0.88/0.97 and generalizing to the public CICIDS and MAWI datasets; the thesis also proposes a deployable LAN-gateway evasion-detection prototype and four DPI-middlebox hardening recommendations (mimic Suricata's strict field validation, enforce RFC-compliant parsing, add ML-based anomaly detection, run regular red-team evaluations).
A complete patent invention-disclosure document describes a "Multipath TCP Functionality Restriction" device deployed inline at a network egress point that identifies the MPTCP TCP option (kind=30, MP_CAPABLE subtype) in initial-handshake SYN/SYN-ACK packets and strips or NOPs it in transit, forcing the connection to fall back to ordinary single-path TCP so that conventional TCP-based inspection and attack detection can be applied to traffic that would otherwise be split across multiple paths.
A user manual for a third-party ATCA traffic-splitter/bypass appliance ("VELA System" / S3300, made by Beijing Ebright Information Technology Co., Ltd., an ATCA chassis form factor matching the "TSG Ether Fabric" hardware documented elsewhere in this corpus) gives example hardware-level ACL rules that bidirectionally drop any TCP flow on port 80/8080 whose payload contains the literal HTTP header bytes "Content-Type: application/octet-stream", "content-Type: audio", or "content-Type: video" — a raw, DPI-independent, byte-pattern flow-drop capability at the switch/ACL level, distinct from TSG's own sapp/MAAT signature engine.
The internal 'MAAT网络流处理配置统一描述框架' engineering manual (v3.1.20, author name redacted, 2021) documents MAAT's Redis-synced rule-compilation framework and its RuleScan/Hyperscan-based pattern-matching engine (libmaatframe.so / librulescan), and records that RuleScan's fast-scan feature caused a production outage on 2019-03-19 and has been disabled ever since.