A June 2024 PhD dissertation from the Institute of Information Engineering, CAS (jointly with Guangzhou University) — "暗网网站指纹识别关键技术研究" (Research on Key Technologies of Website Fingerprinting in the Tor Network) — was supervised by Professor Fang Binxing (方滨兴), publicly known as a principal architect of China's Great Firewall, directly linking a named GFW architect to current academic supervision of Tor website-fingerprinting attack research at an institution documented elsewhere in this corpus as closely tied to MESA Lab/Geedge GFW R&D.

A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.

A 2020 IIE CAS master's thesis (author and advisor names redacted) develops ML methods to identify audio/video traffic within encrypted flows without payload inspection, by quantifying on/off transmission burst patterns and binning long packet-length/timing sequences into short fixed-length feature vectors usable from as little as 5 seconds of traffic, plus a lightweight heuristic-threshold variant with a congestion-correction feature scheme built into a deployed identification system.

MESA Lab researcher notes on an encrypted-video-identification project describe adding SSL-layer information output to more precisely trace a flow's true source/identity, and considering reinforcement learning so the identification model adapts as network conditions change, working within/around sapp's plugin limitations.

A 2024 IIE/CAS PhD opening-report (author and advisor names redacted) lays out a four-part research plan for identifying specific encrypted video content transmitted over QUIC: (1) recovering per-video traffic fingerprints from downlink packet aggregation despite QUIC's full encryption, using linear-fit correction to reconstruct true video-chunk sizes; (2) matching randomized multi-segment video combinations via a random-walk segment model plus a traffic 'language model'; (3) a Siamese attention-CNN with contrastive learning to fingerprint-match mixed audio/video segment streams; and (4) a large-model-based classifier to keep fingerprint matching robust under network degradation and varied playback modes.

A published IIE/CAS paper co-authored by a team of MESA/IIE-CAS and CNCERT/CC researchers (names redacted) describes 'LSTF,' a fast online method for identifying specific encrypted video titles from HTTPS traffic, explicitly naming YouTube as a target: ground-truth fingerprints are built offline by decrypting the stream through mitmproxy to extract plaintext HTTP/MPD chunk-size sequences, then a live target's encrypted chunk-size sequence is matched against that fingerprint database using a Bag-of-Patterns model. The paper frames the motivation explicitly as content control: "it is particularly necessary to identify and supervise illegal videos through network stream."

A CAS PhD mid-term progress report (student name redacted, advisor Fang Binxing) documents original research building a multi-channel temporal convolutional network for client-side Tor website fingerprinting, plus separate cross-site and forwarding-shaping methods aimed at deanonymizing Tor hidden services without operating a guard node. The student's self-collected "MultiLayer20" dataset (500 clearnet sites + 850 hidden services) reached 86.31% top accuracy at the Tor cell layer.