A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.
this paper aims to detect DoH traffic from massive HTTPS traffic through a combination of active and passive methods...this paper studies DoH traffic fingerprinting technology to explore the feasibility of identifying users visiting websites from passive DoH traffic.
Defense implications
- DoH resolvers are actively discovered at scale via lightweight scanning, and passive DoH traffic is fingerprinted at the website-visited level after stripping HTTP/2 control-frame noise -- treat DoH as providing DNS confidentiality only, not connection-unlinkability; encrypted DNS resolution should be paired with cover traffic or routed through the same channel/fingerprint profile as the subsequent connection.
- This work is directly supervised by Fang Binxing, tying a specific circumvention-defeating research pipeline (not generic DPI R&D) to the individual publicly credited as Geedge Networks' founder -- a useful anchor for tracing which academic outputs plausibly feed into commercial TSG features.
Related findings
MESA Lab researcher notes on an encrypted-video-identification project describe adding SSL-layer information output to more precisely trace a flow's true source/identity, and considering reinforcement learning so the identification model adapts as network conditions change, working within/around sapp's plugin limitations.
A 2020 IIE CAS master's thesis (author and advisor names redacted) develops ML methods to identify audio/video traffic within encrypted flows without payload inspection, by quantifying on/off transmission burst patterns and binning long packet-length/timing sequences into short fixed-length feature vectors usable from as little as 5 seconds of traffic, plus a lightweight heuristic-threshold variant with a congestion-correction feature scheme built into a deployed identification system.
An IIE CAS technical whitepaper for the "High-speed Network Traffic Processing and Analysis System" names the "MESA" team (处理架构组MESA团队, "Massive Effective Stream Analysis") as part of IIE's Second Research Office, lists deployment case studies at China's National Administration of State Secrets Protection (国家保密局), the National Computer Network and Information Security Management Center, Guangdong provincial e-government services, and CNCERT (国家互联网应急中心), and gives a named IIE contact (name/phone/email redacted here). The product classifies behavior inside encrypted tunnels (remote control, audio/video calls, encrypted mail, VPN) and dozens of IM/social apps via SSL/SSH/IPSEC/QUIC/SOCKS protocol detection.
A 2020 MESA Lab monthly report describes building a sapp plugin that extracts packet-sequence features specifically "for DoH (DNS-over-HTTPS) service discovery," alongside a broader CSTNET DoH measurement-report effort and configuring a DNS-to-DoH gateway -- confirming sapp is used to fingerprint DoH traffic via statistical sequence features rather than plaintext DNS content.
A 2024 IIE/CAS PhD opening-report (author and advisor names redacted) lays out a four-part research plan for identifying specific encrypted video content transmitted over QUIC: (1) recovering per-video traffic fingerprints from downlink packet aggregation despite QUIC's full encryption, using linear-fit correction to reconstruct true video-chunk sizes; (2) matching randomized multi-segment video combinations via a random-walk segment model plus a traffic 'language model'; (3) a Siamese attention-CNN with contrastive learning to fingerprint-match mixed audio/video segment streams; and (4) a large-model-based classifier to keep fingerprint matching robust under network degradation and varied playback modes.
A 2020 IIE/CAS master's thesis (author and advisor names redacted; the advisor is a recurring MESA Lab supervisor named throughout this corpus), 'Research on Key Technologies of SSL Client Identification for Network Traffic,' proposes labeling training data by decrypting sessions through an SSL transparent-proxy MITM to auto-tag which client application generated each session, then builds a real-time classifier fusing SSL handshake (ClientHello) fingerprints with SSL 'Burst' packet-timing/size features to identify the client application without further decryption, validated against WhatsApp, WeChat, and Facebook traffic.