A WWW 2024 paper co-authored by MESA Lab's PI (MESA Lab PI, IIE-CAS (name redacted)) presents VPNChecker, a graph-based active-probing VPN-server detector modeling cross-port probe-response behavior; the paper states VPNChecker was deployed and evaluated inside a real ISP's network as a complement to existing detection engines, and documents concrete multi-port active-probing signatures for many commercial VPN/circumvention tools (e.g. Psiphon3: {22,53,443}, {22,443,554}, {22,53,443,554}).
Furthermore, we deploy VPNChecker in an Internet Service Provider's (ISP) environment to evaluate its effectiveness. The results show that VPNChecker can improve the coverage of sophisticated detection engines and serve as a complement to existing methods.
Defense implications
- Avoid predictable, fixed multi-port 'probe fingerprints' — a stable set of open auxiliary ports across many server deployments (as several commercial VPNs reportedly use) is exactly the graph signal this detector exploits; vary or minimize open ports per deployment.
Related findings
An internal MESA Lab presentation by a MESA Lab researcher (name/email redacted) describes 'CartoDNS', a global active/passive encrypted-DNS reconnaissance system that uses DNS-watermark injection across multi-region probing nodes to map DoT/DoH/DoQ resolver topology; as of the presentation it had discovered 80,000+ DoT, 20,000+ DoH and 4,000+ DoQ IPv4 resolvers (plus 1,100+ DoT and 500+ DoH over IPv6) and cataloged 500+ service providers with concrete IP ranges (Cloudflare, Google, Quad9, AdGuard, 360, Alibaba, Tencent, etc.), running continuously since December 2021.
An internal TSG functional-requirements spec ('加密协议JG') defines device support for identifying and blocking ECH, ESNI and QUIC traffic via per-connection SNI/region-matching tables (e.g. DF_QUIC_REGION), plus a companion 'FD报文全流程感知' feature that both passively monitors and actively injects synthetic verification traffic end-to-end through the network path to compute a live per-rule 'CT率' (breakthrough/penetration rate) — the system self-measures how often its own QUIC/ESNI/ECH blocks fail to take effect, and separately throttles logging/blocking detail for rule IDs receiving unusually high hit counts (DF_ATTACK_PROTECTION, 'targeted attack detection').
A MESA Lab monthly report states that adjustments to a VPN-detection module accumulated over 10,000 Psiphon3 server IPs and delayed a Psiphon3 client's ability to get online by at least 3 minutes in the researchers' test environment, an earlier-stage data point consistent with the much larger-scale (~70-73K IP) 'vpn-thwarting'/CyberNarrator Psiphon-harvesting pipeline documented elsewhere in this corpus.
An internal MESA course slide deck, '网络空间测绘与安全应用 第四节：测绘的对抗-反测绘' ('Cyberspace Mapping and Security Applications, Section 4: Anti-Reconnaissance'), presented by a MESA Lab PI (name/email redacted), teaches a technique framework — probe-behavior identification/defense, hiding network-resource attributes and behavior, and network deception — for detecting and defeating outside researchers' active measurement of network infrastructure.
A June 2024 MESA/IIE-CAS master's thesis, '开放域名解析服务测绘关键技术研究' (Research on Key Measurement Techniques for Open DNS Resolution Service Reconnaissance), by a graduate student (name redacted), formally names Fang Binxing (方滨兴) — widely credited as the architect of China's Great Firewall — as the thesis advisor, directly tying him to MESA Lab's DNS-infrastructure reconnaissance research program.
MESA Lab group-meeting notes record parallel R&D on a whitelist-filtering module and a project to fingerprint cloud-hosted circumvention/proxy infrastructure at the IP-block (not single-IP) level, explicitly modeled on 2017/2019 academic 'Bulletproof-hosting IP block' research; the notes also mention local packet captures that found Psiphon IPs, the domain types/ratios Psiphon uses, and active-probing behavior with candidate detection countermeasures.