Grityu/model_duplication ("five modes duplication", 2023) built and evaluated ML traffic classifiers (Knn_test.py, ScenarioA.pkl, features.json) using CICFlowMeter flow-feature extraction over labeled pcap captures of major commercial VPN/circumvention tools — Psiphon (including a specific "psiphon_operation" capture), Surfshark over OpenVPN TCP/UDP, TorGuard over OpenVPN UDP and "OpenVPN over SSL", and Hotspot Shield VPN — directly evidencing GFW-side R&D on flow-level statistical fingerprinting of specific VPN products.
REPO PATH: Grityu/model_duplication.bundle; deleted-file commit history references sufshark_openvpn_tcp.pcap, surkshark_openvpn_udp.pcap, torguard_openvpn_udp.pcap, TorGuard_openvpnOverSSL.pcap, HotSpotshieldVPN_纯净流量.pcap, psiphonz纯净流量.pcap, 20230309_fxy_psiphon_operation.pcapng, test_cicflowmeter.py, Knn_test.py, ScenarioA.pkl, features.json
Defense implications
- Lantern's OpenVPN-based or OpenVPN-mimicking transports should assume MESA Lab has trained flow-level (CICFlowMeter-style) ML classifiers directly against Psiphon, Surfshark, TorGuard and Hotspot Shield OpenVPN traffic; distinctive flow statistics (packet-size/timing distributions) from these specific products should not be treated as safe cover traffic to imitate.
Related findings
The same internal research note's second research point develops an ML-based detector for Geneva-style automated censorship-evasion traffic; simple flow-level features (flow size, max packet size, RST/SYN/FIN flag counts, forward init-window bytes, inter-arrival timing) achieve near-perfect (ROC-AUC ~1.00) classification of Geneva-generated evasion traffic against CICIDS2017 and MAWI backbone background traffic using decision trees, LightGBM, XGBoost and random forest, with abnormal flow size (~150 bytes vs. 1000-30000 bytes typical) identified as the single most discriminative feature.
A 2020 MESA Lab monthly report describes building a sapp plugin that extracts packet-sequence features specifically "for DoH (DNS-over-HTTPS) service discovery," alongside a broader CSTNET DoH measurement-report effort and configuring a DNS-to-DoH gateway -- confirming sapp is used to fingerprint DoH traffic via statistical sequence features rather than plaintext DNS content.
A thesis-project assignment for hidden-service (VPN/Proxy/Tor) identification via heterogeneous graph neural networks on flow logs sources its one day of training data from a database explicitly named 'tsg_galaxy_p19' — tying the internal TSG naming convention to the taxonomy's P19/WMS-UTR Pakistan site codename — accessed over an internal 'Information Harbor' (信息港) VPN, with ground-truth hidden-service IP labels supplied by the commercial IP-intelligence service spur.us.
A master's thesis-in-progress supervised within this ecosystem (advisor 杨嵘, senior engineer) is explicitly tied to the national key R&D program "海量公害 网页、图片、视频流量识别技术" (massive nuisance webpage/image/video traffic identification technology) and a VoIP engineering project; it builds cross- platform (YouTube/Facebook/Bilibili) encrypted-video identification that matches a single per-video traffic fingerprint across different CDNs/resolutions/codecs via trend-similarity, fuzzy-search, and meta-learning matching, explicitly framed around detecting "非法视频" (illegal/harmful video) spread across platforms.
A 2024 MESA thesis proposal targets detecting "cross-border apps that illegally transmit personal information" inside encrypted traffic without decryption, by discovering app-specific tracking identifiers as <domain,parameter,value,interval> tuples and clustering flow structural similarity (Euclidean distance in a feature space) to separate device identifiers from background noise via a two-layer recognition model.
Acceptance-test cases for an unnamed internal system show it curates 10,000+ DNS rules tracked for 30+ days each, runs hourly business-anomaly detection and bot-vs-human traffic classification per flagged domain (target accuracy/recall ≥80-95%), and maintains a resulting "abnormal IP" blocklist database of 2,000+ entries — an automated domain/IP flagging pipeline structurally similar to (but not confirmed identical to) the taxonomy's CyberNarrator blocklist-building pattern.