An internal presentation by MESA Lab's "4th Research Office, Processing Architecture Group" reviews the SIGCOMM'23 GGFAST paper's packet-length "snippet" technique for automatically generating encrypted-traffic classifiers, reporting it reaches 97.3% accuracy identifying DoH traffic from as few as 8 length/direction snippets and near-expert F1 scores (0.99+) fingerprinting SSH/RDP authentication methods purely from encrypted flow length patterns — direct evidence the lab evaluates automated length-pattern classifiers for possible operational adoption.
所属团队：第四研究室处理架构组 ... 识别TLS流量中的DoH ... GGFAST输出的分类器准确率达到97.3%，假阳性率为0.06%，真阳性率为95.1%，F1分0.974，使用8个snippets识别DoH行为，最常见的是⟨{165→,146→}, ∗, ∈⟩，代表了Cloudflare DoH请求
Defense implications
- Packet-length-pattern classifiers reportedly match hand-tuned expert classifiers on SSH/RDP auth-method identification and DoH detection using as few as 8 length/direction features and a lightweight naive-Bayes model — any transport meant to blend in should randomize/pad its packet-length schedule, not rely on payload encryption alone, since this research office is actively evaluating exactly this attack class for adoption.
Related findings
A MESA team ("第二研究室 Mesa团队", lead name redacted) technical overview describes the traffic-classification engine underlying TSG/sapp as performing deep field-level parsing across 29 protocols (HTTP with 32 standard + 400+ extended fields; SMTP/POP3/IMAP/DNS/FTP/RTSP/RTMP/HLS/DASH/ SSL/SSH/OpenVPN/BT etc.), and identifies VPN traffic specifically via a two-stage approach -- coarse protocol-signature classification followed by fine-grained statistical/behavioral-feature classification for traffic that can't be matched by signature alone.
The same internal research note's second research point develops an ML-based detector for Geneva-style automated censorship-evasion traffic; simple flow-level features (flow size, max packet size, RST/SYN/FIN flag counts, forward init-window bytes, inter-arrival timing) achieve near-perfect (ROC-AUC ~1.00) classification of Geneva-generated evasion traffic against CICIDS2017 and MAWI backbone background traffic using decision trees, LightGBM, XGBoost and random forest, with abnormal flow size (~150 bytes vs. 1000-30000 bytes typical) identified as the single most discriminative feature.
A 2020 IIE CAS master's thesis (author and advisor names redacted) develops ML methods to identify audio/video traffic within encrypted flows without payload inspection, by quantifying on/off transmission burst patterns and binning long packet-length/timing sequences into short fixed-length feature vectors usable from as little as 5 seconds of traffic, plus a lightweight heuristic-threshold variant with a congestion-correction feature scheme built into a deployed identification system.
A 2020 MESA Lab monthly report describes building a sapp plugin that extracts packet-sequence features specifically "for DoH (DNS-over-HTTPS) service discovery," alongside a broader CSTNET DoH measurement-report effort and configuring a DNS-to-DoH gateway -- confirming sapp is used to fingerprint DoH traffic via statistical sequence features rather than plaintext DNS content.
An internal schema doc describes an 'Unknown Protocol Identification Database': an Elasticsearch port-asset table tracking active/passive/fused protocol-type guesses and banner text per IP:port, feeding a MySQL clustering pipeline (cluster_info/cluster_task) that groups unclassified traffic by a 'fingerprint' field into named-protocol clusters -- an unsupervised discovery pipeline for identifying and naming new/unknown protocols at scale, distinct from MAAT/AppSketch's signature-matching against already-known protocols.
A 2023 IIE/CAS master's thesis (author and advisor names redacted) develops a black-box adversarial-example attack against ML-based malicious-encrypted-traffic classifiers: transferable feature-space perturbations evade LSTM and FS-Net classifiers over 96.2% of the time (over 50.5% against SVM/LR/DNN), and a packet-length-and-timing perturbation algorithm that translates those perturbations into real traffic achieves an 82.1% evasion rate, 29.9 points higher than the prior state-of-the-art black-box method.