Auto-ingest: 10 new papers (2026-10-19)

corpus/findings/2014-cao-survey-encrypted-traffic__encryption-defeats-dpi-forces-statistical.yaml

@@ -0,0 +1,16 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2014-cao-survey-encrypted-traffic
+kind: detection
+summary: Encryption renders port-based and DPI payload-inspection methods ineffective for traffic classification, forcing classifiers to rely on statistical flow features (packet sizes, inter-arrival times, flow duration) and behavioral host-profiling rather than payload content.
+techniques:
+    - dpi
+    - traffic-shape
+    - ml-classifier
+censors:
+    - generic
+defense_implications:
+    - Circumvention transports must also defeat flow-level statistical fingerprinting, not just payload inspection — randomizing packet sizes and inter-arrival times is necessary even when payload is encrypted.
+    - Host behavioral profiling (connection graph, port fan-out patterns) can expose proxy usage independent of payload; transport design should consider connection multiplexing to reduce host-level signatures.
+section: Abstract / §1
+extracted_by: claude-sonnet-4-6

corpus/findings/2014-cao-survey-encrypted-traffic__host-behavioral-profiling-encrypted-classification.yaml

@@ -0,0 +1,15 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2014-cao-survey-encrypted-traffic
+kind: detection
+summary: Behavioral and host-profiling classifiers (BLINC, SubFlow, host-behavior analysis) enable multi-level traffic classification by correlating port usage, connection graphs, and communication patterns across hosts — achieving fine-grained identification without payload or even per-packet inspection.
+techniques:
+    - ml-classifier
+    - traffic-shape
+censors:
+    - generic
+defense_implications:
+    - Connection-graph and port fan-out signatures can identify proxy behavior at the network/host level; circumvention tools should tunnel all traffic through a single persistent connection to minimize the host-level behavioral footprint.
+    - Hierarchical classifiers can escalate from coarse (is this encrypted?) to fine-grained (which application?) — defense must defeat each layer, not just the payload-inspection layer.
+section: References (Karagiannis 2005 ref 31, Jaber 2012 ref 24, Xie 2012 ref 26)
+extracted_by: claude-sonnet-4-6

corpus/findings/2014-cao-survey-encrypted-traffic__ml-classifier-encrypted-app-identification.yaml

@@ -0,0 +1,15 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2014-cao-survey-encrypted-traffic
+kind: detection
+summary: Supervised and unsupervised machine-learning classifiers (flow-feature vectors, Markov chain fingerprinting) can identify encrypted application traffic — including SSH, Skype, P2P, and VoIP — without access to plaintext payload, achieving practical real-time operation.
+techniques:
+    - ml-classifier
+    - traffic-shape
+censors:
+    - generic
+defense_implications:
+    - Flow-level ML classifiers are a credible threat even against fully encrypted transports; defense requires shaping the packet-size and timing distribution to match a benign cover protocol, not just encrypting content.
+    - Markov chain fingerprinting (Korczynski & Duda, INFOCOM 2014) can expose stateful protocol patterns even in encrypted streams — transports should inject deliberate noise into state-transition sequences.
+section: References §3–4 (Nguyen 2008, Korczynski 2014, Alshammari 2009)
+extracted_by: claude-sonnet-4-6

corpus/findings/2014-cao-survey-encrypted-traffic__protocol-mimicry-limits-parrot-dead.yaml

@@ -0,0 +1,19 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2014-cao-survey-encrypted-traffic
+kind: defense
+summary: Protocol mimicry defenses (SkypeMorph, StegoTorus, obfsproxy, FTE) were the dominant circumvention strategy as of 2014, but the 'Parrot is Dead' analysis (Houmansadr et al., IEEE S&P 2013) and 'Peek-a-boo' (Dyer et al., IEEE S&P 2012) showed that naive mimicry fails because classifiers can distinguish imperfect imitations at flow level.
+techniques:
+    - traffic-shape
+    - ml-classifier
+defenses:
+    - mimicry
+    - pluggable-transport
+    - format-transform
+censors:
+    - generic
+defense_implications:
+    - Surface-level mimicry of a protocol (copying header fields, rough packet-size distribution) is insufficient; cryptographically enforced format-transformation (FTE) or tunneling inside a real implementation of the cover protocol is required.
+    - 'Designers should treat flow-level distinguishability as a first-class threat model: run a trained ML classifier against their own transport traffic and measure false-negative rate before deployment.'
+section: References (Houmansadr 2013 ref 42, Dyer 2012 ref 41, Mohajeri 2012 ref 18, Dyer 2013 ref 19)
+extracted_by: claude-sonnet-4-6

corpus/findings/2022-gfw-report-great-firewall-china__gfw-censorship-detection-methodology.yaml

@@ -0,0 +1,16 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2022-gfw-report-great-firewall-china
+kind: evaluation
+summary: 'Two empirically-validated methods for independently detecting GFW censorship are documented: (1) Send a DNS query to a non-DNS server outside China — any DNS response received is necessarily forged by the GFW; (2) Send a TLS ClientHello with the target SNI to an open port of a server outside China — a TCP RST (openssl errno=104) indicates likely SNI censorship. Both methods require a control domain (e.g., baidu.com) to rule out false positives.'
+techniques:
+    - sni-blocking
+    - dns-poisoning
+    - rst-injection
+censors:
+    - cn
+defense_implications:
+    - These lightweight probes (a single dig or openssl command) can be incorporated into circumvention client health checks to detect whether specific proxy domain names or SNI values have been added to the GFW blocklist.
+    - The non-DNS-server DNS probe technique is particularly useful for continuous monitoring because it requires no in-country infrastructure beyond a client — any server outside China on a non-DNS port can serve as a canary.
+section: Issue body (Q&A section)
+extracted_by: claude-sonnet-4-6

corpus/findings/2022-gfw-report-great-firewall-china__gfw-dns-injection-layered-google.yaml

@@ -0,0 +1,14 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2022-gfw-report-great-firewall-china
+kind: detection
+summary: 'DNS injection for google.com and *.google.com began on September 30, 2022 — eight days after SNI-based blocking — with the GFW injecting forged DNS responses containing incorrect IP addresses. The GFW''s three DNS injectors behave differently: google.com is censored by all three injectors, while *.google.com is censored only by injectors 2 and 3. The injected fake addresses include real IPs belonging to other companies (e.g., 69.63.184.14 belonging to Facebook).'
+techniques:
+    - dns-poisoning
+censors:
+    - cn
+defense_implications:
+    - Use DNS-over-HTTPS or DNS-over-TLS resolved entirely outside China to bypass GFW DNS injection; plaintext UDP/53 queries traversing the Chinese border are subject to forged responses regardless of the resolver specified.
+    - Account for per-injector heterogeneity when building detection or monitoring tools — inconsistent blocking across GFW injectors means a single measurement point may give a false-negative.
+section: Issue body
+extracted_by: claude-sonnet-4-6

corpus/findings/2022-gfw-report-great-firewall-china__gfw-google-partial-rollback-2023.yaml

@@ -0,0 +1,15 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2022-gfw-report-great-firewall-china
+kind: deployment
+summary: 'By February 1, 2023, the *.google.com wildcard rule was removed from GFW blocking rules. Of the original 1,147 affected domains, only 47 remained censored, including high-value services: docs.google.com, drive.google.com, play.google.com, accounts.google.com, and sites.google.com.'
+techniques:
+    - sni-blocking
+    - dns-poisoning
+censors:
+    - cn
+defense_implications:
+    - GFW blocking rules are mutable and regularly revised; circumvention infrastructure that works around a broad wildcard block should be designed to handle selective re-blocking of specific subdomains without requiring full redeploy.
+    - Monitor domain-level reachability continuously — a rollback of a wildcard rule can silently re-expose previously-blocked domains as usable cover traffic or fronting targets.
+section: Comment (gfw-report, Feb 1 2024)
+extracted_by: claude-sonnet-4-6

corpus/findings/2022-gfw-report-great-firewall-china__gfw-sni-rst-google-2022.yaml

@@ -0,0 +1,15 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2022-gfw-report-great-firewall-china
+kind: detection
+summary: The GFW examines TLS ClientHello SNI values and, when a match is found against the blacklist, immediately injects forged TCP RST packets to tear down the connection. SNI-based censorship of google.com and *.google.com began on September 22, 2022 (between 6:23 AM–7:33 PM Beijing Time), blocking all 1,147 tested *.google.com domains without exception.
+techniques:
+    - sni-blocking
+    - rst-injection
+censors:
+    - cn
+defense_implications:
+    - Encrypt the SNI field using Encrypted ClientHello (ECH) to prevent the GFW from matching against its SNI blacklist — the absence of a readable SNI defeats this class of detection entirely.
+    - When fronting traffic through a CDN or TLS-mimicking proxy, verify that the outer SNI used is not itself on the GFW blocklist, since even a pass-through SNI triggers RST injection.
+section: Issue body
+extracted_by: claude-sonnet-4-6

corpus/findings/2022-gfw-report-great-firewall-china__gfw-wildcard-collateral-damage-domestic.yaml

@@ -0,0 +1,15 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2022-gfw-report-great-firewall-china
+kind: deployment
+summary: 'Blocking *.google.com via a wildcard rule produced significant collateral damage: ns1.google.com — the authoritative name server for google.cn and 265.com (domestic Chinese services operated by Beijing Gu Xiang/Google China) — was also blocked, potentially disrupting domestic Chinese internet services that depend on Google''s nameserver infrastructure. This effect lasted approximately 24 hours before partial rollback.'
+techniques:
+    - dns-poisoning
+    - sni-blocking
+censors:
+    - cn
+defense_implications:
+    - Circumvention tools that rely on wildcard-exempted domains (e.g., domestic services sharing infrastructure with a foreign target) should treat that exemption as fragile — broad censor rule changes can inadvertently block them as collateral damage.
+    - Monitoring collateral-damage signals (domestic service outages coinciding with censorship events) can help correlate censor infrastructure changes faster than direct probe data alone.
+section: Comment (UjuiUjuMandan, Jun 2 2025)
+extracted_by: claude-sonnet-4-6

corpus/findings/2026-anon-clash__clash-verge-merge-prepend-behavior.yaml

@@ -0,0 +1,17 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2026-anon-clash
+kind: deployment
+summary: Clash Verge Rev v2.5.8's merge engine does not recognize `prepend-rule-providers` or `prepend-rules` as valid injection directives; writing a top-level `rules` key in extension YAML replaces the entire rule table rather than prepending to it. The correct extension path requires either the visual rule editor's prepend area or a JavaScript extension script that explicitly splices new entries before `config.rules`.
+defenses:
+    - shadowsocks
+    - vless
+    - vmess
+    - trojan
+censors:
+    - cn
+defense_implications:
+    - When designing subscription update mechanisms, ensure the update format supports incremental rule injection rather than full replacement — full replacement breaks user customizations on every subscription refresh.
+    - Provide a JavaScript scripting API (analogous to Clash Verge's Script mechanism) so power users can programmatically prepend rules without risking clobber from subscription updates.
+section: 第 1 步：为当前订阅添加规则集
+extracted_by: claude-sonnet-4-6

corpus/findings/2026-anon-clash__loyalsoldier-clash-rules-deployment.yaml

@@ -0,0 +1,20 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2026-anon-clash
+kind: deployment
+summary: The Loyalsoldier/clash-rules repository (~30k GitHub stars as of early 2026) functions as the de facto standard domain-routing rule set for Clash clients operating in China, integrating V2Ray community domain and IP lists with automated daily rebuilds via GitHub Actions at 6:30 AM. It provides per-service granularity for Apple, Google, Telegram, and Chinese IP ranges across 11 distinct rule set files.
+techniques:
+    - ip-blocking
+    - dpi
+defenses:
+    - shadowsocks
+    - vless
+    - vmess
+    - trojan
+censors:
+    - cn
+defense_implications:
+    - Maintain daily-refreshed domain/IP blocklists as a first-class circumvention client feature; static bundled lists become stale within days as the GFW blocklist evolves.
+    - Distribute rule sets via CDN (jsDelivr pattern) rather than bundling them in the client binary to allow independent update cadence without app-store releases.
+section: 推荐规则库：Loyalsoldier/clash-rules
+extracted_by: claude-sonnet-4-6

corpus/findings/2026-anon-clash__routing-rules-ip-reputation-orthogonal.yaml

@@ -0,0 +1,19 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2026-anon-clash
+kind: evaluation
+summary: Proxy routing rules are explicitly documented as unable to change exit node IP reputation (datacenter vs. residential), unable to guarantee streaming service geo-unlock, and unable to prevent account risk-control actions triggered by the service provider. Routing correctness and IP quality are orthogonal concerns.
+techniques:
+    - ip-blocking
+defenses:
+    - shadowsocks
+    - vmess
+    - vless
+    - trojan
+censors:
+    - cn
+defense_implications:
+    - Circumvention tool designers must distinguish between blocking circumvention (censor-side, addressed by obfuscation) and service-side geo/fraud detection (addressed by residential IP sourcing) — the same node cannot solve both problems via rule configuration alone.
+    - Document residential vs. datacenter IP characteristics prominently; users conflate 'unblocked access' with 'full service access' and blame the proxy when streaming libraries are geo-restricted.
+section: 规则不会改变节点 IP 的信誉
+extracted_by: claude-sonnet-4-6

corpus/findings/2026-anon-clash__rule-set-cdn-update-cadence.yaml

@@ -0,0 +1,20 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2026-anon-clash
+kind: deployment
+summary: The Loyalsoldier rule set uses an 86400-second (24-hour) refresh interval via jsDelivr CDN URLs, with 11 rule set files spanning domain behavior (reject, iCloud, Apple, Google, proxy, direct, private), IP CIDR behavior (Telegram CIDRs, China CN CIDRs, LAN CIDRs), and classical/application-level behavior (P2P applications). Rule set download success is contingent on client ability to reach the CDN URL — the interval setting is not proof of successful update.
+techniques:
+    - ip-blocking
+defenses:
+    - shadowsocks
+    - vless
+    - vmess
+    - trojan
+    - hysteria2
+censors:
+    - cn
+defense_implications:
+    - CDN-hosted rule distribution (jsDelivr) creates a dependency on CDN reachability from within China; circumvention clients should cache rule sets locally and fall back gracefully when the CDN is unreachable.
+    - Surface rule set last-updated timestamps and download health in the client UI — users cannot distinguish 'rule set applied' from 'rule set downloaded successfully' without explicit status reporting.
+section: 第 3 步：应用并验证
+extracted_by: claude-sonnet-4-6

corpus/findings/2026-anon-clash__three-policy-split-tunneling-model.yaml

@@ -0,0 +1,21 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2026-anon-clash
+kind: defense
+summary: The canonical three-policy routing model for China-facing circumvention clients categorizes flows as DIRECT (domestic sites/IPs, private ranges, P2P applications), PROXY (Google, Twitter, Telegram, Netflix, and other blocked services), and REJECT (ad/tracker domains), evaluated top-to-bottom with first-match-wins semantics. The fallback policy is subscription-defined and must be explicitly preserved.
+techniques:
+    - ip-blocking
+    - dpi
+defenses:
+    - shadowsocks
+    - vmess
+    - vless
+    - trojan
+    - hysteria2
+censors:
+    - cn
+defense_implications:
+    - Implement split-tunneling by default rather than routing all traffic through the proxy; domestic traffic on DIRECT avoids latency penalty and reduces proxy bandwidth costs.
+    - Ensure the client exposes a 'Rule' mode distinct from 'Global' (all-proxy) and 'Direct' (all-bypass) modes — users frequently misconfigure global mode and wonder why circumvention is slow.
+section: 什么是 Clash 规则？为什么一定要配？
+extracted_by: claude-sonnet-4-6

corpus/findings/2026-lee-effectiveness-netflow-based-deanonymization__commodity-router-monitors-100k-ips-feasibly.yaml

@@ -0,0 +1,15 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2026-lee-effectiveness-netflow-based-deanonymization
+kind: evaluation
+summary: A Juniper MX204 router ($40,350, released 2017) can monitor 100,000 active IP addresses simultaneously with J-Flow (Juniper's NetFlow/IPFIX implementation) at 1:1,000 sampling during 636,000-pps realistic traffic, with zero packet drops, zero monitoring errors, a maximum relative error of 0.05%, and CPU/memory utilization indistinguishable from baseline. Storing the resulting telemetry requires only ≈516 MB/day (15.6 GB/month), well within commodity ISP capacity.
+techniques:
+    - flow-correlation
+    - traffic-shape
+censors:
+    - generic
+defense_implications:
+    - The low hardware cost and operational overhead of NetFlow-based deanonymization mean the threat is not limited to intelligence agencies; any well-resourced ISP operator is a realistic adversary, so circumvention tool threat models should include regional and commercial ISPs, not only nation-state signals-intelligence units.
+    - Because the data-collection infrastructure is already deployed in most ISP networks (standard NetFlow for traffic engineering), no additional attacker-side deployment is needed; circumvention tools cannot detect or disrupt the monitoring itself.
+section: §3.2, Table 2
+extracted_by: claude-sonnet-4-6

corpus/findings/2026-lee-effectiveness-netflow-based-deanonymization__introduction-request-induction-deanonymization.yaml

@@ -0,0 +1,17 @@
+# Auto-extracted by corpus-findings from full paper text.
+# Review summary + tags before relying.
+paper: 2026-lee-effectiveness-netflow-based-deanonymization
+kind: detection
+summary: The introduction-inducing attack—sending batches of Tor introduction requests at 15 requests/min without downloading any content—achieves 100% isolated and 98% large-scale deanonymization success, removing the application-specific assumption that the target onion service supports reliable file downloads. High-rate introduction flooding (1,383 req/min) degrades to 13.5–24% success because it activates Tor's puzzle-based DoS defense, which suppresses the induced traffic signal.
+techniques:
+    - flow-correlation
+    - active-probing
+defenses:
+    - tor
+censors:
+    - generic
+defense_implications:
+    - Circumvention tools that expose a standard Tor onion-service address as their relay endpoint are vulnerable to introduction-inducing deanonymization regardless of the application layer; consider non-standard rendezvous mechanisms or private introduction points not listed in the public directory.
+    - Tor's puzzle-based DoS defense inadvertently provides partial protection against high-rate introduction flooding; onion services used for circumvention should enable puzzle defenses as a secondary benefit.
+section: §5.2, Table 6
+extracted_by: claude-sonnet-4-6