An internal schema doc describes an 'Unknown Protocol Identification Database': an Elasticsearch port-asset table tracking active/passive/fused protocol-type guesses and banner text per IP:port, feeding a MySQL clustering pipeline (cluster_info/cluster_task) that groups unclassified traffic by a 'fingerprint' field into named-protocol clusters -- an unsupervised discovery pipeline for identifying and naming new/unknown protocols at scale, distinct from MAAT/AppSketch's signature-matching against already-known protocols.

The same 2024 IIE CAS thesis proposes 'PED' (Packet-context based Evasion Detection): an XGBoost flow-feature pre-filter followed by a GRU-based autoencoder trained on packet-context features (inter-packet plus protocol-layer, including HTTP-layer fields) that flags DPI-evasion traffic via reconstruction error, reporting accuracy/ROC-AUC above 0.88/0.97 and generalizing to the public CICIDS and MAWI datasets; the thesis also proposes a deployable LAN-gateway evasion-detection prototype and four DPI-middlebox hardening recommendations (mimic Suricata's strict field validation, enforce RFC-compliant parsing, add ML-based anomaly detection, run regular red-team evaluations).

An IIE CAS technical whitepaper for the "High-speed Network Traffic Processing and Analysis System" names the "MESA" team (处理架构组MESA团队, "Massive Effective Stream Analysis") as part of IIE's Second Research Office, lists deployment case studies at China's National Administration of State Secrets Protection (国家保密局), the National Computer Network and Information Security Management Center, Guangdong provincial e-government services, and CNCERT (国家互联网应急中心), and gives a named IIE contact (name/phone/email redacted here). The product classifies behavior inside encrypted tunnels (remote control, audio/video calls, encrypted mail, VPN) and dozens of IM/social apps via SSL/SSH/IPSEC/QUIC/SOCKS protocol detection.

A 2024 University of Chinese Academy of Sciences course taught within MESA Lab's research group (instructor name redacted) trains students to fingerprint and detect censorship-measurement tools -- OONI Probe's fixed built-in control-server domains, ICLab's User-Agent behavior, and the large-domain-fan-out pattern shared by Satellite/Iris/Quack/GFWatch -- and to build ML classifiers (citing IEEE Access 2019, CoNeXT 2019 CLAP, and USENIX 2023 ML-TRW) that detect DPI-evasion probing traffic in the style of Geneva and StateDiver, explicitly framed as protecting DPI middleware from being probed and evaded.

Reveals internal architecture of TSG's traffic classification engine: the 'sapp' process (binary at /opt/tsg/sapp/sapp, version sapp-4.2.90) uses a packet-I/O layer called 'marsio', a custom app-identification plugin 'app_sketch_local' (identify_app_by_tcp_payload / identify_app_by_user_define_attributes), and an embedded LuaJIT ('libelua') for user-defined protocol signatures (e.g. custom Modbus detection) — concurrent LUA script loading crashes the classification worker.

MESA Lab engineering logs (2020) describe development and TSG-environment testing of a SAPP plugin that identifies encrypted audio/video traffic and distinguishes on-demand from live streams. The workflow uses Fiddler (a TLS MITM proxy) to decrypt traffic client-side and auto-label training data for the underlying ML model, and required a dlopen() workaround to load libpython.so for the model at runtime.

An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.