A UCAS master's thesis repo by an Institute of Information Engineering (Chinese Academy of Sciences)-affiliated researcher (chenguanlin_thesis, referencing the PACK algorithm, content-based classification, and a YouTube test image) and a related MESA Lab repo by the same author (chenguanlin/td_evaluation) that builds 'video ID' fingerprints from traffic (vedio_id_build.c) and evaluates detection accuracy with formal mistake/lost-rate statistics together indicate applied R&D on identifying specific video content from traffic patterns -- a content-fingerprinting capability beyond simple protocol classification.
src/dataset_build/vedio_id_build.c ; src/get_td_mistake_lost/get_lost_rate.c ; src/get_td_mistake_lost/get_mistake_level.c ; Img/youtube.png ; Img/PACKalgorithm_re.jpg
Defense implications
- Traffic-analysis research at this level of maturity (content identification at individual-video granularity, with formal false-positive/false-negative evaluation tooling) could plausibly identify which resource is being fetched through a circumvention tunnel purely from encrypted traffic shape (packet sizes/timing) -- validate padding/shaping defenses specifically against per-resource identification, not just protocol-family classification.
Related findings
A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.
A 2020 IIE CAS master's thesis (author and advisor names redacted) develops ML methods to identify audio/video traffic within encrypted flows without payload inspection, by quantifying on/off transmission burst patterns and binning long packet-length/timing sequences into short fixed-length feature vectors usable from as little as 5 seconds of traffic, plus a lightweight heuristic-threshold variant with a congestion-correction feature scheme built into a deployed identification system.
MESA Lab researcher notes on an encrypted-video-identification project describe adding SSL-layer information output to more precisely trace a flow's true source/identity, and considering reinforcement learning so the identification model adapts as network conditions change, working within/around sapp's plugin limitations.
A 2024 IIE/CAS PhD opening-report (author and advisor names redacted) lays out a four-part research plan for identifying specific encrypted video content transmitted over QUIC: (1) recovering per-video traffic fingerprints from downlink packet aggregation despite QUIC's full encryption, using linear-fit correction to reconstruct true video-chunk sizes; (2) matching randomized multi-segment video combinations via a random-walk segment model plus a traffic 'language model'; (3) a Siamese attention-CNN with contrastive learning to fingerprint-match mixed audio/video segment streams; and (4) a large-model-based classifier to keep fingerprint matching robust under network degradation and varied playback modes.
A master's thesis-in-progress supervised within this ecosystem (advisor name redacted, senior engineer) is explicitly tied to the national key R&D program "海量公害 网页、图片、视频流量识别技术" (massive nuisance webpage/image/video traffic identification technology) and a VoIP engineering project; it builds cross- platform (YouTube/Facebook/Bilibili) encrypted-video identification that matches a single per-video traffic fingerprint across different CDNs/resolutions/codecs via trend-similarity, fuzzy-search, and meta-learning matching, explicitly framed around detecting "非法视频" (illegal/harmful video) spread across platforms.
A 2024 IIE CAS thesis proposal (advisor name redacted, a senior-grade engineer) explicitly frames "website identification under ECH encryption" as necessary infrastructure for China's CAC/MIIT/MPS "Clean Web"/"Sword Net" enforcement campaigns, and reports concrete progress already made: a Go-based DNS active-probing framework scanning 1.7B+ domains at roughly 11,000 domains/sec to build a global ECH-deployment map (10 anonymity sets / 79 domains found as of April 2024), and an already-implemented ECH-flow filter keyed on the TLS extension-type IDs used across ECH draft versions 07-18, with planned work on cross-flow traffic correlation plus raw-byte/flow-feature fusion to identify the specific site within an ECH anonymity set.