A 2024 University of Chinese Academy of Sciences course taught within MESA Lab's research group (instructor name redacted) trains students to fingerprint and detect censorship-measurement tools -- OONI Probe's fixed built-in control-server domains, ICLab's User-Agent behavior, and the large-domain-fan-out pattern shared by Satellite/Iris/Quack/GFWatch -- and to build ML classifiers (citing IEEE Access 2019, CoNeXT 2019 CLAP, and USENIX 2023 ML-TRW) that detect DPI-evasion probing traffic in the style of Geneva and StateDiver, explicitly framed as protecting DPI middleware from being probed and evaded.

A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.

The same 2024 IIE CAS thesis proposes 'PED' (Packet-context based Evasion Detection): an XGBoost flow-feature pre-filter followed by a GRU-based autoencoder trained on packet-context features (inter-packet plus protocol-layer, including HTTP-layer fields) that flags DPI-evasion traffic via reconstruction error, reporting accuracy/ROC-AUC above 0.88/0.97 and generalizing to the public CICIDS and MAWI datasets; the thesis also proposes a deployable LAN-gateway evasion-detection prototype and four DPI-middlebox hardening recommendations (mimic Suricata's strict field validation, enforce RFC-compliant parsing, add ML-based anomaly detection, run regular red-team evaluations).

A 2018 MESA Lab monthly report describes work on the "GPS"/"先导" (Pioneer) active-probing projects: adding IPv6 scanning support and simultaneous 3-domain scanning to MAAT, alongside active-probing experiments (nslookup/dig/nmap) and root-DNS-server BGP-anycast measurement -- indicating MAAT's rule engine is paired with an active network-scanning subsystem, not purely passive/inline matching.

An IIE CAS technical whitepaper for the "High-speed Network Traffic Processing and Analysis System" names the "MESA" team (处理架构组MESA团队, "Massive Effective Stream Analysis") as part of IIE's Second Research Office, lists deployment case studies at China's National Administration of State Secrets Protection (国家保密局), the National Computer Network and Information Security Management Center, Guangdong provincial e-government services, and CNCERT (国家互联网应急中心), and gives a named IIE contact (name/phone/email redacted here). The product classifies behavior inside encrypted tunnels (remote control, audio/video calls, encrypted mail, VPN) and dozens of IM/social apps via SSL/SSH/IPSEC/QUIC/SOCKS protocol detection.

An internal schema doc describes an 'Unknown Protocol Identification Database': an Elasticsearch port-asset table tracking active/passive/fused protocol-type guesses and banner text per IP:port, feeding a MySQL clustering pipeline (cluster_info/cluster_task) that groups unclassified traffic by a 'fingerprint' field into named-protocol clusters -- an unsupervised discovery pipeline for identifying and naming new/unknown protocols at scale, distinct from MAAT/AppSketch's signature-matching against already-known protocols.

A 2024 CAS/IIE master's mid-term thesis report, "面向DPI中间件的探测行为识别关键技术研究" (Key Technologies for Identifying Probing Behavior Targeting DPI Middleboxes), builds and evaluates a system that detects and fingerprints active-measurement traffic from OONI, Censored Planet, and GFWatch/GFWeb (via their server-contact patterns, distinct-domain-count thresholds, and response-timing signatures — e.g. flagging a probing srcIP once it queries ≥500-2000 distinct domains at one dstIP), and separately trains a graph-neural-network classifier on raw packet bytes to detect Geneva/SymTCP-style automated censorship-evasion probes, explicitly framed as reducing the DPI middlebox's exposure of its own characteristics to circumvention researchers.