A complete patent invention-disclosure document describes a "Multipath TCP Functionality Restriction" device deployed inline at a network egress point that identifies the MPTCP TCP option (kind=30, MP_CAPABLE subtype) in initial-handshake SYN/SYN-ACK packets and strips or NOPs it in transit, forcing the connection to fall back to ordinary single-path TCP so that conventional TCP-based inspection and attack detection can be applied to traffic that would otherwise be split across multiple paths.

An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.

A 2023 MESA Lab monthly report describes the 'TF' project's active-defense work: test cases for serial ('串联') HTTP hijack/tamper and parallel ('并联') DNS race-injection ('DNS抢答'), performance tuning that scaled active-defense capacity from 3 to 5 units, converting two existing TSG boxes to active-defense mode, and rewriting the active-defense flow-control logic to no longer depend on sapp.

A June 2024 IIE CAS master's thesis (author and advisor names redacted) built a genetic-algorithm + simulated-annealing evasion-traffic generator and, from Sept-Dec 2023, ran live tests against national government HTTP-censorship DPI middleboxes it labels 'RU,' 'KZ,' and 'IN,' plus open-source Snort2/3 and Suricata, cataloging per-target working evasion techniques (e.g. Host-header duplication and field-case manipulation defeat the RU target's Host-based filter; the IN target returns a ~1.2KB block page instead of dropping the connection) in a country-by-technique table, and benchmarked generation efficiency against the open-source 'Geneva' evasion tool from academic circumvention research. NOTE: neither 'ru' (Russia) nor 'in' (India) exists yet as a censor entry in this corpus's taxonomy -- flagged as new-censor candidates; 'kz' already maps to Kazakhstan, a confirmed TSG export site (K18).

The same 2024 IIE CAS thesis proposes 'PED' (Packet-context based Evasion Detection): an XGBoost flow-feature pre-filter followed by a GRU-based autoencoder trained on packet-context features (inter-packet plus protocol-layer, including HTTP-layer fields) that flags DPI-evasion traffic via reconstruction error, reporting accuracy/ROC-AUC above 0.88/0.97 and generalizing to the public CICIDS and MAWI datasets; the thesis also proposes a deployable LAN-gateway evasion-detection prototype and four DPI-middlebox hardening recommendations (mimic Suricata's strict field validation, enforce RFC-compliant parsing, add ML-based anomaly detection, run regular red-team evaluations).

A 2023 MESA Lab monthly report (author and advisor names redacted) describes the 'TF' project's active-defense work: testing serial HTTP hijack/tamper and parallel DNS race-injection ('DNS抢答'), scaling active-defense compute boards from 3 to 5, converting two existing TSG units to active-defense mode, and rewriting active-defense flow control to no longer depend on sapp. NOTE: this content is nearly identical to the existing corpus finding 2026-084104-tf-active-defense (artifact 084104aa052e) -- likely the same underlying document ingested under two different artifact IDs; flagged for dedup review.

TSG implements heuristic tunnel-protocol detection distinguishing Teredo (IPv6-over-UDP, default port 3544) from GTP tunneling based on UDP payload inspection, used to decide 'innermost' session attribution for firewall matching.