Thesis-defense revision notes for a MESA-adjacent CAS-institute master's thesis describe a YouTube video-title identification system that decrypts HTTPS video traffic between a crawler and video servers via mitmproxy, then fingerprints each video from per-chunk HTTP response timing/size derived from a corpus of 38,000 YouTube video chunks (identification method: response-time-distribution based).
当采用mitmproxy进行代理解密后，对于每一条HTTP请求会标识出其对应的传输五元组信息（源IP、目的IP、源端口、目的端口、协议）...进一步的，本文分析了来自 YouTube 网站的 38,000 个视频块的 TCP 有效负载总和
Defense implications
- Chunk-timing/size fingerprinting of long-lived encrypted video-like streams applies to any large-object transfer Lantern proxies; introducing timing jitter and padding at the transport layer would blunt this class of response-time fingerprint.
Related findings
A 2023 master's thesis from the Institute of Information Engineering, Chinese Academy of Sciences (MESA Lab's parent institute) develops an online encrypted-video-stream title identification method using response-time distribution and chunk-fingerprint matching that survives CDN node switching, reporting 96.19% title-identification accuracy using only 6 observed video chunks, without decrypting traffic.
A master's thesis-in-progress supervised within this ecosystem (advisor 杨嵘, senior engineer) is explicitly tied to the national key R&D program "海量公害 网页、图片、视频流量识别技术" (massive nuisance webpage/image/video traffic identification technology) and a VoIP engineering project; it builds cross- platform (YouTube/Facebook/Bilibili) encrypted-video identification that matches a single per-video traffic fingerprint across different CDNs/resolutions/codecs via trend-similarity, fuzzy-search, and meta-learning matching, explicitly framed around detecting "非法视频" (illegal/harmful video) spread across platforms.
An internal "网站/应用资源测绘" (website/app resource-mapping) presentation describes active EDNS-Client-Subnet DNS probing from many simulated geographic vantage points to map Google's and Facebook's global service-IP distribution by country/province, a mobile-app pipeline combining UI automation with MITM-proxy/ SSL-pinning-bypass to extract button-to-URL mappings from decrypted app traffic, and a "网站指纹审查" section that explicitly documents domain fronting as an effective evasion of its own DNS/SNI/Host-based website-fingerprint detection, alongside literature-based behavioral/ML website-fingerprinting intended to survive the QUIC/ECH/DoH transition.
A MESA Lab git repo (wangmeiqi/obfs4_meek_snowflake) trains closed-world Deep Fingerprinting (DF) website-fingerprinting classifiers (ClosedWorld_DF_NoDef.py) using pre-trained Keras models specifically for Tor's obfs4 pluggable transport, meek domain-fronting, and Snowflake -- the same transport families Lantern's own circumvention stack draws on.
Geedge runs a video-content-fingerprinting pipeline: a crawler pulls YouTube videos by topic, routed through mitmproxy with a custom trusted root CA to intercept TLS and capture per-video traffic, targeting ~100 captures per topic.
A patent draft (applicant not present in the extracted text, but topically and methodologically identical to MESA Lab's SAPP audio/video-identification plugin work in the same corpus) describes a content-level encrypted-video identification system: an SNI-triggered flow classifier groups downlink ACK-aligned packets into 'chunks', converts the chunk-size sequence into a long/short word-frequency signature, and matches it in O(1) against a fingerprint database built by actively crawling target sites through a MITM proxy. Tested on 1,000 YouTube videos captured from 5 locations, it reaches 96.19% accuracy needing only 6 online chunks at 3.33us per match, 90x+ faster than three prior published methods it benchmarks against.