A repo path-labeled "K18_NTCS_WEB" (backend service "argus-service", originally developed as "maat_service") defines per-protocol raw-log and business-rule types spanning HTTP, SSL, DNS, SSH, FTP, Mail, P2P, and VoIP, and the VPN/tunnel protocols PPTP, L2TP, IPsec, and OpenVPN, plus a dedicated keyword-based URL log (NtcKeywordsUrlLog) and a RADIUS collection log (NtcCollectRadiusLog) — showing the K18 (Kazakhstan)-labeled monitoring platform logs keyword-hit URLs and carrier RADIUS data alongside full protocol-specific traffic logs.

A June 2024 IIE CAS master's thesis (author and advisor names redacted) built a genetic-algorithm + simulated-annealing evasion-traffic generator and, from Sept-Dec 2023, ran live tests against national government HTTP-censorship DPI middleboxes it labels 'RU,' 'KZ,' and 'IN,' plus open-source Snort2/3 and Suricata, cataloging per-target working evasion techniques (e.g. Host-header duplication and field-case manipulation defeat the RU target's Host-based filter; the IN target returns a ~1.2KB block page instead of dropping the connection) in a country-by-technique table, and benchmarked generation efficiency against the open-source 'Geneva' evasion tool from academic circumvention research. NOTE: neither 'ru' (Russia) nor 'in' (India) exists yet as a censor entry in this corpus's taxonomy -- flagged as new-censor candidates; 'kz' already maps to Kazakhstan, a confirmed TSG export site (K18).

Commit history for the K18 (Kazakhstan) argus-ntc console reveals its concrete feature set: a scheduled "网页关键字定时器" (webpage-keyword timer/scheduler) for keyword filtering, ASN/IP block-list configuration pages, a "BGP泛收" (BGP wide-collection) page, an SSL-interception config toggle, a file-scanning results page with MALWARE TYPE/MALWARE NAME columns, app-identification entries including a WhatsApp rename, and a VoIP business-config approval workflow, with blocking actions relabeled from "阻断" (block) to "封堵(丢弃)" (interdict/drop).

K18_NTCS_WEB/NTC (git.mesalab.cn) is the Java/Spring web console for Kazakhstan's (K18) National Traffic Control System. Its domain model implements per-protocol keyword filtering (App/ASN/DNS/FTP/Mail/P2P/SSL keyword configs), an HTTPS proxy-MITM object (PxyObjTrustedCaCert.java), and explicit content-manipulation templates for HTTPS Redirect and Replace (complex/IP-based) plus Hijack/Insert actions, all managed through this customer-facing K18 control panel.

The GitLab group itself is named "K18_NTCS_WEB" (K18 = Kazakhstan), and its "nfs" web app implements per-protocol keyword-filter configuration classes (App/FTP/Mail/P2P/SSL keyword configs), an OpenVPN IP-list config, RADIUS-based logging/reporting entities, MAAT rule-sync beans, and an explicit "IP spoofing" business feature with its own "PXY仿冒地址池" (proxy spoofed-address pool) and dedicated policy-log support -- the single strongest piece of evidence in this batch tying named keyword-filtering plus IP-spoofing capabilities directly to the Kazakhstan deployment.

The service_flow_config.properties / default_config.properties shipped in both radius-relationship-hbase and relationship-gtpc-user hardcode an identical Windows build/tools path, "D:\K18-Phase2\tsgSpace\dat\tsg\", tying these two Galaxy subscriber-correlation components' build/packaging environment to the K18 (Kazakhstan) site codename already established elsewhere in this corpus — independent, source-derived corroboration that mobile-core GTP-C and RADIUS-relationship correlation tooling was built/packaged specifically in the context of the Kazakhstan deployment.

The internal 'MAAT网络流处理配置统一描述框架' engineering manual (v3.1.20, author name redacted, 2021) documents MAAT's Redis-synced rule-compilation framework and its RuleScan/Hyperscan-based pattern-matching engine (libmaatframe.so / librulescan), and records that RuleScan's fast-scan feature caused a production outage on 2019-03-19 and has been disabled ever since.