Random / high-entropy payload detection

Exported AppSketch/MAAT signature-object JSON shows named per-VPN detection rules combining multiple independent vectors: CyberGhost's WireGuard variant is matched by a hex UDP-payload pattern (04000000*), destination port 1337, and ip.proto=17 together (signature cyberghostvpn_wireguard); Windscribe's OpenVPN control channel is matched by two offset-anchored hex byte patterns plus an exact 86-byte payload length (windscribevpn_openvpn_payload); and ExpressVPN is matched independently via a literal JA3 hash (ssl.analysis.ja3), FQDN strings (expressapisv2.com, www.expressvpn.works), and a large enumerated IP list (700+ individual ip.dst entries observed before the 200KB text-extraction cutoff).

liuchang/mesa_sts packages the NIST SP800-22 statistical randomness test suite (frequency, block-frequency, cusum, discrete Fourier transform, linear complexity, longest-run-of-ones, (non)overlapping template matchings, poker, random excursions, rank, runs, serial, universal, approximate entropy) as "MESA_sts", exposed with a documented "randomlooking check" with per-test-function enable switches (branch feature-add_switch_for_randomlooking), and tested against captured WeChat voice-call (MMTLS) and Telegram MTProto (IPv4/IPv6, multiple key-negotiation variants) traffic — i.e. a production statistical-randomness classifier for identifying fully-encrypted/obfuscated protocol traffic.

A MESA graduate-project spec ("网络流量随机性检测技术研究与系统实现") calls for a prototype implementing 10+ classical statistical randomness tests (frequency, approximate-entropy, runs, matrix-rank, overlapping-subsequence, autocorrelation, etc., in C, 3000+ LOC) against TCP/UDP payloads to classify traffic as "encrypted data flow" (high entropy) vs. not, trained/validated on a 50GB+ labeled corpus of actively-generated encrypted and compressed traffic.