An IIE/CAS graduate mid-term thesis builds a simulated-annealing-enhanced genetic-algorithm tool that auto-generates Geneva-style TCP/IP and HTTP-field evasion strategies and measures them against live censorship middleware in Russia and China: raw TCP/IP-layer evasion succeeds only 0.14% of the time end-to-end (most real web servers reject the malformed packets), HTTP-field mutation (Host/Version/Path) succeeds 5.2% of the time, China implements both Host- and stricter Keyword-based middleware blocking versus Russia's Host-only blocking, and Russia's middleware proved roughly 6x more vulnerable to the generated evasion set than China's; the next thesis phase builds an ML classifier trained on HTTP Host/Version/ Method/Path fields specifically to detect this evasion traffic class.
IP/TCP协议规避攻击：0.14%的请求能够规避成功（规避有效性）。HTTP协议规避攻击：5.2%的请求能被服务器正确处理（规避可用性）。 针对RU审查中间件的规避攻击是CN审查中间件的6倍，RU审查中间件比CN审查中间件更加脆弱。CN存在基于Host和Keyword的审查机制，RU只存在基于Host审查机制。
Defense implications
- Header/field-mutation evasion (Host/Version/Path tricks) is measurably more viable against real infrastructure than raw TCP/IP TCB-desync tricks, but this specific lab is explicitly building ML detectors keyed on exactly those HTTP fields -- favor obfuscation that generalizes poorly for a classifier trained on Host/Version/Method/Path anomalies rather than well-known RFC-violation tricks from the public literature.
- Keyword-based inspection (not just Host-based) is confirmed as the stricter, harder-to-evade layer specifically in China -- evasion strategies that only defeat Host/SNI-based blocking are insufficient there.
Related findings
An internal MESA Lab research note directly measures and compares China's ('CN') HTTP censorship middlebox against Russia, India and an unlabeled 'HZ' system, plus open-source Snort2/Snort3/Suricata: China is characterized as inspecting Host- and keyword-based triggers (example trigger given: a request containing the parameter 'q=ultrasurf') across ALL ports rather than just 80/443, responding with a triple RST or an extra RST+ACK; an 8-technique HTTP-request-mangling evasion comparison table credits China's middlebox as vulnerable only to request-line whitespace insertion and HTTP-version tampering, fewer categories than the other three systems tested.
An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.
The internal 'MAAT网络流处理配置统一描述框架' engineering manual (v3.1.20, author name redacted, 2021) documents MAAT's Redis-synced rule-compilation framework and its RuleScan/Hyperscan-based pattern-matching engine (libmaatframe.so / librulescan), and records that RuleScan's fast-scan feature caused a production outage on 2019-03-19 and has been disabled ever since.
A 2023 MESA Lab monthly report describes the 'TF' project's active-defense work: test cases for serial ('串联') HTTP hijack/tamper and parallel ('并联') DNS race-injection ('DNS抢答'), performance tuning that scaled active-defense capacity from 3 to 5 units, converting two existing TSG boxes to active-defense mode, and rewriting the active-defense flow-control logic to no longer depend on sapp.
A live tsg_master engine config file exposes a [RESET] section with concrete TCP-RST-injection parameters (NUM=1, SEED1=65535, SEED2=13, FLAGS=20, DIR=3, REMEDY=0), a [TRAFFIC_MIRROR] section confirming mirror-tap deployment (NIC_NAME="eth_vf_mirr"), a [MAAT] section wiring tsg_master directly to MAAT's subscriber-ID tables (TSG_OBJ_SUBSCRIBER_ID/TSG_DYN_SUBSCRIBER_IP), and a device tag "BeiJing-XXG" confirming this specific instance is a domestic Beijing deployment. A plaintext Kafka SASL credential (SASL_PASSWD="galaxy2019") is also exposed, and "galaxy" recurs as an internal project codename elsewhere in this batch (docker service path /home/galaxy, APP_BRIDGE_NAME).
The Xinjiang Mobile carrier traffic report (2023-05-15) states in its own QUIC-domain-ranking section that Xinjiang's intra-provincial traffic has begun carrying QUIC/HTTP3 (UDP-based) traffic that poses "a huge challenge" to the traditional parallel/out-of-band ("并联") traffic-access blocking method, and that effectively gatekeeping ("GK") UDP/QUIC traffic requires switching to an inline/in-path ("串联") blocking architecture — a direct internal admission that (as of mid-2023, in this province) the standard mirror-tap deployment could not reliably block QUIC.