Internal materials include a full copy of the academic paper 'OS Fingerprinting and Tethering Detection in Mobile Networks' (Yi-Chao Chen, Yong Liao, Mario Baldi, Sung-Ju Lee, Lili Qiu; UT Austin / Narus Inc.), which proposes TCP/IP-stack-timing-based techniques (IP TTL, IP-ID monotonicity, TCP window-scale option, TCP timestamp, clock frequency, boot time) for detecting a device's OS and whether it is tethering -- suggesting this line of research was studied as reference material for TSG's mobile-network device/VPN-tethering fingerprinting features (the glimpse_detector / licensed-DPI-engine VPN-detection capability).

A MESA team ("第二研究室 Mesa团队", lead name redacted) technical overview describes the traffic-classification engine underlying TSG/sapp as performing deep field-level parsing across 29 protocols (HTTP with 32 standard + 400+ extended fields; SMTP/POP3/IMAP/DNS/FTP/RTSP/RTMP/HLS/DASH/ SSL/SSH/OpenVPN/BT etc.), and identifies VPN traffic specifically via a two-stage approach -- coarse protocol-signature classification followed by fine-grained statistical/behavioral-feature classification for traffic that can't be matched by signature alone.

An Aug 2024 internal R&D presentation ("加密视频流量识别研究概述") describes a working encrypted-video content-fingerprinting system that builds per-(video_id, itag) chunk-size-sequence fingerprints from 1000+ YouTube videos (first 600s each, collected at multiple network vantage points) and matches live DASH/HLS chunk-size sequences against that library in real time, achieving 96%+ title-identification accuracy from just 6 chunks (~12 seconds of playback) with microsecond match latency; the system is currently passive-observation only, with the team explicitly noting they don't know whether enabling active blocking on this signal would prompt the server side to adopt randomized padding as a countermeasure.

Two IIE graduate-research repos (cuiyiming/gradproj, a 2019-2020 master's thesis project citing NDSS'17 TLS-interception-measurement and TLS-client-identification papers; daxiaoxu/xmr_bsexpr2, a 2022 project with GRU-based sequence classifiers over TCP/DNS flow JSON and deleted docs on TLS1.3 and Tencent's proprietary MMTLS protocol) document the ML feature-engineering methodology (TLS certificate length, handshake message sequences, JA3-style statistics, Markov-chain packet-size/timing models, GRU sequence models) that plausibly underlies production classifiers (e.g. stellar's later JA4/JA4S support, MESA_sts's randomness checks).

A MESA research-log entry details a NAT/shared-connection identification methodology combining TCP/IP fingerprinting (IP-ID, TTL, DF, window size, MSS, TCP-option ordering -- p0f-style), HTTP User-Agent diversity, TLS/SSL JA3 fingerprint diversity, and traffic statistical features (concurrent-TCP-connection count, idle-time jitter, upstream/downstream ratio stability, DNS query frequency) per endpoint over rolling time windows, with detection methods spanning direct UA inspection, threshold statistics, ML classifiers (random forest/SVM), and per-window entropy jumps across the fingerprint features.

During QuarkVPN feature extraction, Geedge found client/server roles over UDP distinguishable by port-number heuristic (server's fixed ports 59001/59002/60000 exceed the client's random port), though this heuristic is currently causing misidentification, filed as an open bug.

A MESA Lab repo (daxiaoxu/xmr_bsexpr3) contains standalone detection/fingerprinting scripts specifically targeting QQ (Mobile and Windows clients) and WeChat, alongside a script named PSK_LifeTime.py, suggesting TLS session-resumption / PSK-ticket lifetime is being explored as a traffic-fingerprinting feature for identifying or tracking these apps' encrypted sessions.