A November 2024 CAS master's thesis proposal (student and advisor names redacted) proposes a prototype system that detects and continuously monitors IPs performing DPI-middlebox measurement/probing (in the style of OONI/GFWatch) using heuristic behavioral differences from normal users, and separately detects protocol-level evasion of DPI middleware -- extending beyond TCP-layer-only prior work to HTTP/DNS-layer field manipulation -- using graph-based representations of evasion traffic.

A 2018 MESA Lab monthly report describes work on the "GPS"/"先导" (Pioneer) active-probing projects: adding IPv6 scanning support and simultaneous 3-domain scanning to MAAT, alongside active-probing experiments (nslookup/dig/nmap) and root-DNS-server BGP-anycast measurement -- indicating MAAT's rule engine is paired with an active network-scanning subsystem, not purely passive/inline matching.

A 2024 University of Chinese Academy of Sciences course taught within MESA Lab's research group (instructor name redacted) trains students to fingerprint and detect censorship-measurement tools -- OONI Probe's fixed built-in control-server domains, ICLab's User-Agent behavior, and the large-domain-fan-out pattern shared by Satellite/Iris/Quack/GFWatch -- and to build ML classifiers (citing IEEE Access 2019, CoNeXT 2019 CLAP, and USENIX 2023 ML-TRW) that detect DPI-evasion probing traffic in the style of Geneva and StateDiver, explicitly framed as protecting DPI middleware from being probed and evaded.

An internal MESA Lab presentation by a MESA Lab researcher (name/email redacted) describes 'CartoDNS', a global active/passive encrypted-DNS reconnaissance system that uses DNS-watermark injection across multi-region probing nodes to map DoT/DoH/DoQ resolver topology; as of the presentation it had discovered 80,000+ DoT, 20,000+ DoH and 4,000+ DoQ IPv4 resolvers (plus 1,100+ DoT and 500+ DoH over IPv6) and cataloged 500+ service providers with concrete IP ranges (Cloudflare, Google, Quad9, AdGuard, 360, Alibaba, Tencent, etc.), running continuously since December 2021.

An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.

The internal 'MAAT网络流处理配置统一描述框架' engineering manual (v3.1.20, author name redacted, 2021) documents MAAT's Redis-synced rule-compilation framework and its RuleScan/Hyperscan-based pattern-matching engine (libmaatframe.so / librulescan), and records that RuleScan's fast-scan feature caused a production outage on 2019-03-19 and has been disabled ever since.

An internal TSG functional-requirements spec ('加密协议JG') defines device support for identifying and blocking ECH, ESNI and QUIC traffic via per-connection SNI/region-matching tables (e.g. DF_QUIC_REGION), plus a companion 'FD报文全流程感知' feature that both passively monitors and actively injects synthetic verification traffic end-to-end through the network path to compute a live per-rule 'CT率' (breakthrough/penetration rate) — the system self-measures how often its own QUIC/ESNI/ECH blocks fail to take effect, and separately throttles logging/blocking detail for rule IDs receiving unusually high hit counts (DF_ATTACK_PROTECTION, 'targeted attack detection').