A MESA research-log entry details a NAT/shared-connection identification methodology combining TCP/IP fingerprinting (IP-ID, TTL, DF, window size, MSS, TCP-option ordering -- p0f-style), HTTP User-Agent diversity, TLS/SSL JA3 fingerprint diversity, and traffic statistical features (concurrent-TCP-connection count, idle-time jitter, upstream/downstream ratio stability, DNS query frequency) per endpoint over rolling time windows, with detection methods spanning direct UA inspection, threshold statistics, ML classifiers (random forest/SVM), and per-window entropy jumps across the fingerprint features.

Two IIE graduate-research repos (cuiyiming/gradproj, a 2019-2020 master's thesis project citing NDSS'17 TLS-interception-measurement and TLS-client-identification papers; daxiaoxu/xmr_bsexpr2, a 2022 project with GRU-based sequence classifiers over TCP/DNS flow JSON and deleted docs on TLS1.3 and Tencent's proprietary MMTLS protocol) document the ML feature-engineering methodology (TLS certificate length, handshake message sequences, JA3-style statistics, Markov-chain packet-size/timing models, GRU sequence models) that plausibly underlies production classifiers (e.g. stellar's later JA4/JA4S support, MESA_sts's randomness checks).

A 2020 MESA Lab monthly report describes building a sapp plugin that extracts packet-sequence features specifically "for DoH (DNS-over-HTTPS) service discovery," alongside a broader CSTNET DoH measurement-report effort and configuring a DNS-to-DoH gateway -- confirming sapp is used to fingerprint DoH traffic via statistical sequence features rather than plaintext DNS content.

A 2020 IIE/CAS master's thesis (author and advisor names redacted; the advisor is a recurring MESA Lab supervisor named throughout this corpus), 'Research on Key Technologies of SSL Client Identification for Network Traffic,' proposes labeling training data by decrypting sessions through an SSL transparent-proxy MITM to auto-tag which client application generated each session, then builds a real-time classifier fusing SSL handshake (ClientHello) fingerprints with SSL 'Burst' packet-timing/size features to identify the client application without further decryption, validated against WhatsApp, WeChat, and Facebook traffic.

A MESA team ("第二研究室 Mesa团队", lead name redacted) technical overview describes the traffic-classification engine underlying TSG/sapp as performing deep field-level parsing across 29 protocols (HTTP with 32 standard + 400+ extended fields; SMTP/POP3/IMAP/DNS/FTP/RTSP/RTMP/HLS/DASH/ SSL/SSH/OpenVPN/BT etc.), and identifies VPN traffic specifically via a two-stage approach -- coarse protocol-signature classification followed by fine-grained statistical/behavioral-feature classification for traffic that can't be matched by signature alone.

An internal research writeup ("研究点二：基于GRU神经网络的共享接入IP检测技术") builds a GRU/CNN model over sequences of TLS JA3/SNI/session-ticket and HTTP cookie fingerprints, trained on 6 days / 155GB of mirrored traffic captured from an internal gateway named "华严网关" (Huayan Gateway), to determine whether a single source IP represents one device or several devices sharing that IP (e.g. behind a NAT/proxy), reporting precision 0.844 / recall 0.874 / F1 0.859.

A MESA Lab repo (daxiaoxu/xmr_bsexpr3) contains standalone detection/fingerprinting scripts specifically targeting QQ (Mobile and Windows clients) and WeChat, alongside a script named PSK_LifeTime.py, suggesting TLS session-resumption / PSK-ticket lifetime is being explored as a traffic-fingerprinting feature for identifying or tracking these apps' encrypted sessions.