An internal system-design document for a "Web Fingerprint" module specifies a mirrored-traffic system that identifies specific web pages a monitored individual visits over encrypted connections (the worked example given is a specific politically-related YouTube channel homepage) and specific search-engine keywords typed into Google search (the worked example target keyword given is "FLG", i.e. Falun Gong), with accuracy targets of >=90% page-identification precision and >=95% keyword recall, feeding a downstream "reputation" scoring module. A companion Python implementation with a real "dataset_24_youtube_ fingerprints.csv" dataset performs the YouTube-page fingerprinting using picture-count and request-size-sequence features, and is explicitly scoped in its file path to a "特定开放通道" (a specific open/circumvention channel).
针对用户访问特定网站（如youtube），能够识别出该用户是否访问了我们关注的网页（如涉政up主的主页），如果是，具体到哪一个网页；针对用户使用google搜索的场景，能够识别出该用户是否搜索了我们关注的关键词（如FLG），如果是，具体到搜索了什么。
Defense implications
- This targets individual-level, page-granular and search-keyword-granular surveillance over encrypted (including circumvention-channel) traffic, not just domain-level blocking -- padding/shaping defenses aimed only at hiding which *site* a user visits are insufficient against this threat model, since it also targets which *page* and which *search terms*.
- The explicit 'FLG' (Falun Gong) target keyword is concrete evidence this pipeline is built for identifying specific political/dissident search activity, not generic content filtering.
Related findings
A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.
A 2020 IIE CAS master's thesis (author and advisor names redacted) develops ML methods to identify audio/video traffic within encrypted flows without payload inspection, by quantifying on/off transmission burst patterns and binning long packet-length/timing sequences into short fixed-length feature vectors usable from as little as 5 seconds of traffic, plus a lightweight heuristic-threshold variant with a congestion-correction feature scheme built into a deployed identification system.
MESA Lab researcher notes on an encrypted-video-identification project describe adding SSL-layer information output to more precisely trace a flow's true source/identity, and considering reinforcement learning so the identification model adapts as network conditions change, working within/around sapp's plugin limitations.
A 2024 IIE/CAS PhD opening-report (author and advisor names redacted) lays out a four-part research plan for identifying specific encrypted video content transmitted over QUIC: (1) recovering per-video traffic fingerprints from downlink packet aggregation despite QUIC's full encryption, using linear-fit correction to reconstruct true video-chunk sizes; (2) matching randomized multi-segment video combinations via a random-walk segment model plus a traffic 'language model'; (3) a Siamese attention-CNN with contrastive learning to fingerprint-match mixed audio/video segment streams; and (4) a large-model-based classifier to keep fingerprint matching robust under network degradation and varied playback modes.
The same internal research note's second research point develops an ML-based detector for Geneva-style automated censorship-evasion traffic; simple flow-level features (flow size, max packet size, RST/SYN/FIN flag counts, forward init-window bytes, inter-arrival timing) achieve near-perfect (ROC-AUC ~1.00) classification of Geneva-generated evasion traffic against CICIDS2017 and MAWI backbone background traffic using decision trees, LightGBM, XGBoost and random forest, with abnormal flow size (~150 bytes vs. 1000-30000 bytes typical) identified as the single most discriminative feature.
The same 2024 IIE CAS thesis proposes 'PED' (Packet-context based Evasion Detection): an XGBoost flow-feature pre-filter followed by a GRU-based autoencoder trained on packet-context features (inter-packet plus protocol-layer, including HTTP-layer fields) that flags DPI-evasion traffic via reconstruction error, reporting accuracy/ROC-AUC above 0.88/0.97 and generalizing to the public CICIDS and MAWI datasets; the thesis also proposes a deployable LAN-gateway evasion-detection prototype and four DPI-middlebox hardening recommendations (mimic Suricata's strict field validation, enforce RFC-compliant parsing, add ML-based anomaly detection, run regular red-team evaluations).