Website fingerprinting
A June 2022 IIE CAS master's thesis, 'Research on Key Technologies of DoH Traffic Identification' (author name redacted, supervised by Professor Fang Binxing -- publicly known as chief architect of the Great Firewall and later Geedge Networks' founder/chief scientist), develops: (1) a light-load connection-multiplexing active scanner to discover DoH resolvers at scale, (2) a one-class ML classifier trained only on DoH samples plus TLS statistical features to catch DoH traffic missed by rule matching, and (3) a DoH fingerprinting method that strips HTTP/2 control-frame noise -- explicitly aimed at 'identifying users visiting websites from passive DoH traffic,' i.e. website fingerprinting through encrypted-DNS-wrapped connections.
A 2020 IIE CAS master's thesis (author and advisor names redacted) develops ML methods to identify audio/video traffic within encrypted flows without payload inspection, by quantifying on/off transmission burst patterns and binning long packet-length/timing sequences into short fixed-length feature vectors usable from as little as 5 seconds of traffic, plus a lightweight heuristic-threshold variant with a congestion-correction feature scheme built into a deployed identification system.
MESA Lab researcher notes on an encrypted-video-identification project describe adding SSL-layer information output to more precisely trace a flow's true source/identity, and considering reinforcement learning so the identification model adapts as network conditions change, working within/around sapp's plugin limitations.
A 2024 IIE/CAS PhD opening-report (author and advisor names redacted) lays out a four-part research plan for identifying specific encrypted video content transmitted over QUIC: (1) recovering per-video traffic fingerprints from downlink packet aggregation despite QUIC's full encryption, using linear-fit correction to reconstruct true video-chunk sizes; (2) matching randomized multi-segment video combinations via a random-walk segment model plus a traffic 'language model'; (3) a Siamese attention-CNN with contrastive learning to fingerprint-match mixed audio/video segment streams; and (4) a large-model-based classifier to keep fingerprint matching robust under network degradation and varied playback modes.
A published IIE/CAS paper co-authored by a team of MESA/IIE-CAS and CNCERT/CC researchers (names redacted) describes 'LSTF,' a fast online method for identifying specific encrypted video titles from HTTPS traffic, explicitly naming YouTube as a target: ground-truth fingerprints are built offline by decrypting the stream through mitmproxy to extract plaintext HTTP/MPD chunk-size sequences, then a live target's encrypted chunk-size sequence is matched against that fingerprint database using a Bag-of-Patterns model. The paper frames the motivation explicitly as content control: "it is particularly necessary to identify and supervise illegal videos through network stream."
A 2023 master's thesis from the Institute of Information Engineering, Chinese Academy of Sciences (MESA Lab's parent institute) develops an online encrypted-video-stream title identification method using response-time distribution and chunk-fingerprint matching that survives CDN node switching, reporting 96.19% title-identification accuracy using only 6 observed video chunks, without decrypting traffic.
A master's thesis-in-progress supervised within this ecosystem (advisor name redacted, senior engineer) is explicitly tied to the national key R&D program "海量公害 网页、图片、视频流量识别技术" (massive nuisance webpage/image/video traffic identification technology) and a VoIP engineering project; it builds cross- platform (YouTube/Facebook/Bilibili) encrypted-video identification that matches a single per-video traffic fingerprint across different CDNs/resolutions/codecs via trend-similarity, fuzzy-search, and meta-learning matching, explicitly framed around detecting "非法视频" (illegal/harmful video) spread across platforms.
An Aug 2024 internal R&D presentation ("加密视频流量识别研究概述") describes a working encrypted-video content-fingerprinting system that builds per-(video_id, itag) chunk-size-sequence fingerprints from 1000+ YouTube videos (first 600s each, collected at multiple network vantage points) and matches live DASH/HLS chunk-size sequences against that library in real time, achieving 96%+ title-identification accuracy from just 6 chunks (~12 seconds of playback) with microsecond match latency; the system is currently passive-observation only, with the team explicitly noting they don't know whether enabling active blocking on this signal would prompt the server side to adopt randomized padding as a countermeasure.
A 2024 IIE CAS thesis proposal (advisor name redacted, a senior-grade engineer) explicitly frames "website identification under ECH encryption" as necessary infrastructure for China's CAC/MIIT/MPS "Clean Web"/"Sword Net" enforcement campaigns, and reports concrete progress already made: a Go-based DNS active-probing framework scanning 1.7B+ domains at roughly 11,000 domains/sec to build a global ECH-deployment map (10 anonymity sets / 79 domains found as of April 2024), and an already-implemented ECH-flow filter keyed on the TLS extension-type IDs used across ECH draft versions 07-18, with planned work on cross-flow traffic correlation plus raw-byte/flow-feature fusion to identify the specific site within an ECH anonymity set.
A June 2024 PhD dissertation from the Institute of Information Engineering, CAS (jointly with Guangzhou University) — "暗网网站指纹识别关键技术研究" (Research on Key Technologies of Website Fingerprinting in the Tor Network) — was supervised by Professor Fang Binxing (方滨兴), publicly known as a principal architect of China's Great Firewall, directly linking a named GFW architect to current academic supervision of Tor website-fingerprinting attack research at an institution documented elsewhere in this corpus as closely tied to MESA Lab/Geedge GFW R&D.
An internal "网站/应用资源测绘" (website/app resource-mapping) presentation describes active EDNS-Client-Subnet DNS probing from many simulated geographic vantage points to map Google's and Facebook's global service-IP distribution by country/province, a mobile-app pipeline combining UI automation with MITM-proxy/ SSL-pinning-bypass to extract button-to-URL mappings from decrypted app traffic, and a "网站指纹审查" section that explicitly documents domain fronting as an effective evasion of its own DNS/SNI/Host-based website-fingerprint detection, alongside literature-based behavioral/ML website-fingerprinting intended to survive the QUIC/ECH/DoH transition.
A CAS PhD mid-term progress report (student name redacted, advisor Fang Binxing) documents original research building a multi-channel temporal convolutional network for client-side Tor website fingerprinting, plus separate cross-site and forwarding-shaping methods aimed at deanonymizing Tor hidden services without operating a guard node. The student's self-collected "MultiLayer20" dataset (500 clearnet sites + 850 hidden services) reached 86.31% top accuracy at the Tor cell layer.
An internal system-design document for a "Web Fingerprint" module specifies a mirrored-traffic system that identifies specific web pages a monitored individual visits over encrypted connections (the worked example given is a specific politically-related YouTube channel homepage) and specific search-engine keywords typed into Google search (the worked example target keyword given is "FLG", i.e. Falun Gong), with accuracy targets of >=90% page-identification precision and >=95% keyword recall, feeding a downstream "reputation" scoring module. A companion Python implementation with a real "dataset_24_youtube_ fingerprints.csv" dataset performs the YouTube-page fingerprinting using picture-count and request-size-sequence features, and is explicitly scoped in its file path to a "特定开放通道" (a specific open/circumvention channel).
A MESA Lab git repo (wangmeiqi/obfs4_meek_snowflake) trains closed-world Deep Fingerprinting (DF) website-fingerprinting classifiers (ClosedWorld_DF_NoDef.py) using pre-trained Keras models specifically for Tor's obfs4 pluggable transport, meek domain-fronting, and Snowflake -- the same transport families Lantern's own circumvention stack draws on.
Geedge runs a video-content-fingerprinting pipeline: a crawler pulls YouTube videos by topic, routed through mitmproxy with a custom trusted root CA to intercept TLS and capture per-video traffic, targeting ~100 captures per topic.
A patent draft (applicant not present in the extracted text, but topically and methodologically identical to MESA Lab's SAPP audio/video-identification plugin work in the same corpus) describes a content-level encrypted-video identification system: an SNI-triggered flow classifier groups downlink ACK-aligned packets into 'chunks', converts the chunk-size sequence into a long/short word-frequency signature, and matches it in O(1) against a fingerprint database built by actively crawling target sites through a MITM proxy. Tested on 1,000 YouTube videos captured from 5 locations, it reaches 96.19% accuracy needing only 6 online chunks at 3.33us per match, 90x+ faster than three prior published methods it benchmarks against.
A MESA Lab experiment re-identifies individual users across time solely from which domains they visit, using one-hot/frequency "domain access vectors" (Jaccard, overlap-coefficient, cosine, Euclidean) computed against real production HTTP logs pulled from a ClickHouse table named tsg_galaxy_v3.connection_record_log_http_domain. The best-performing configuration (Alexa top 100-10000 domain list, overlap coefficient) distinguished the same user's adjacent-hour sessions from other users' sessions with high separation (~0.19 vs ~0.88 average difference).
A UCAS master's thesis repo by an Institute of Information Engineering (Chinese Academy of Sciences)-affiliated researcher (chenguanlin_thesis, referencing the PACK algorithm, content-based classification, and a YouTube test image) and a related MESA Lab repo by the same author (chenguanlin/td_evaluation) that builds 'video ID' fingerprints from traffic (vedio_id_build.c) and evaluates detection accuracy with formal mistake/lost-rate statistics together indicate applied R&D on identifying specific video content from traffic patterns -- a content-fingerprinting capability beyond simple protocol classification.
A CAS-institute thesis ("面向加密场景的视频入口发现关键技术研究") builds a system that associates known encrypted video-resource traffic back to its hosting webpage/app "entry" domain even when the video itself is served from generic CDN infrastructure, using co-occurrence/sequence mining plus active-learning ranking (XGBoost) partly trained on plaintext-flow ground truth; the author's prior project record lists a "某音视频节目库项目" funded under the national "242" information-security special program (2019–2020), and the thesis is explicitly framed as enabling detection of "有害视频" (harmful video) sources.
wangmeiqi/wfp_dataprocess is a small MESA Lab repo ("WFP实验设计" = "WFP [Website Fingerprinting] experiment design") containing a connection-dataset builder script, indicating active internal research into Website Fingerprinting attacks — identifying which site a user visits from encrypted/proxied traffic patterns alone.
MESA Lab researchers built and iterated a Scapy-based website-fingerprinting classifier that identifies specific YouTube videos from encrypted traffic by matching the packet-size sequence of thumbnail-image requests (triggered on SNI yt3.googleusercontent.com / yt3.ggpht.com) against a pre-built reference dataset (dataset_24_youtube_fingerprints.csv), scoring candidate matches on sequence overlap and total-payload-size ratio against fixed thresholds (0.65 / 0.85).
A document framed as a patent disclosure ("本发明", "the present invention") describes building a YouTube video-fingerprint database by collecting 1,000 videos across 10 categories from 5 collection sites, pairing MITM-decrypted plaintext video-chunk info (via mitmproxy) with the corresponding encrypted flow captured via tshark, yielding a dataset of 1,000 video fingerprints and 2,493 encrypted video flows; the authors then analyze fingerprint continuity in streamed (non-downloaded) encrypted flows, finding 698 of 2,493 flows (~28%) show missing or duplicated chunks against the fingerprint database.
Thesis-defense revision notes for a MESA-adjacent CAS-institute master's thesis describe a YouTube video-title identification system that decrypts HTTPS video traffic between a crawler and video servers via mitmproxy, then fingerprints each video from per-chunk HTTP response timing/size derived from a corpus of 38,000 YouTube video chunks (identification method: response-time-distribution based).