MESA Lab researcher notes on an encrypted-video-identification project describe adding SSL-layer information output to more precisely trace a flow's true source/identity, and considering reinforcement learning so the identification model adapts as network conditions change, working within/around sapp's plugin limitations.
增加SSL层的信息输出，要求能更有效的定位到该流源自哪里，更能表面该流量的身份；考虑加入强化学习方面的内容来适应流量环境的改变
Defense implications
- Ongoing R&D explicitly targets per-flow content/source identification within TLS (not just protocol identification) and adapting to changing network conditions via reinforcement learning -- fingerprint-resistant padding schemes should assume an adaptive/learning classifier adversary, not a fixed rule set.
Related findings
A 2020 MESA Lab monthly report describes building a sapp plugin that extracts packet-sequence features specifically "for DoH (DNS-over-HTTPS) service discovery," alongside a broader CSTNET DoH measurement-report effort and configuring a DNS-to-DoH gateway -- confirming sapp is used to fingerprint DoH traffic via statistical sequence features rather than plaintext DNS content.
A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.
The MESA_Platform/gquic sapp plugin extracts SNI and User-Agent across a wide range of QUIC implementations/versions (Google QUIC 23/25/33/34/35/37/39/41/43/44/46/48/50, IETF QUIC draft-29 and RFC9000, plus QUANT/PicoQUIC/quic-go/quicly/MsQuic/mvfst/TQUIC), including a dedicated Aug 2021 feature to 'support parsing encrypted SNI for QUIC RFC9000' — i.e. the DPI engine derives/decrypts QUIC Initial-packet protection to recover the TLS ClientHello SNI even from RFC9000's protected header.
A raw production SSL/TLS session log from sapp's monitoring pipeline (timestamps dated 2021-08-23, client IPs in domestic Chinese carrier ranges) shows the per-connection logging schema includes dedicated fields for a captured certificate chain (INDIVIDUAL_CERT_FILE, MIDDLE_CERT_FILE, ROOT_CERT_FILE, CHAIN_CERT_FILE) and for any injected packet (INJECTED_PKT_FILE), alongside SNI and TLS version -- confirming sapp's live SNI-logging and MITM-cert-capture instrumentation was operating against real user traffic to services including huobi.com, steamcommunity.com, and dropbox.com.
A performance bug at a domestic Xinjiang test site (25-70Gbps) traced packet-processing lock contention to a plugin named "tsg_vulpes" calling an ONNX Runtime model for real-time "encrypted voice recognition" on live traffic; disabling this ML classifier resolved packet loss, indicating it's an optional, performance-costly add-on.
Reveals internal architecture of TSG's traffic classification engine: the 'sapp' process (binary at /opt/tsg/sapp/sapp, version sapp-4.2.90) uses a packet-I/O layer called 'marsio', a custom app-identification plugin 'app_sketch_local' (identify_app_by_tcp_payload / identify_app_by_user_define_attributes), and an embedded LuaJIT ('libelua') for user-defined protocol signatures (e.g. custom Modbus detection) — concurrent LUA script loading crashes the classification worker.