FINDING · DEFENSE

To match legitimate user behavior, the Camouflage dispatcher enforces empirically derived per-protocol session time limits: email 1–3 minutes, file sharing 5–10 minutes, instant messaging 15–20 minutes, and VoIP 20–30 minutes (Table 1). Sessions exceeding these windows produce a detectable deviation from population-level usage norms.

From 2016-zarras-leveraging — Leveraging Internet Services to Evade Censorship · §5.2, Table 1 · 2016 · Information Security Conference

Implications

Implement hard per-protocol session time budgets derived from usage studies and enforce protocol rotation before sessions exceed the observed window
Expose per-user calibration of session durations, since age and regional cultural factors significantly shift normal usage distributions and a population-average default may itself be anomalous in a specific locale