The classification model generalizes across different encrypted web protocols including HTTP/2 and QUIC, achieving high accuracy for both service-level and application-level classification objectives from a single trained model.

The paper demonstrates that domain-specific considerations for encrypted web protocols are routinely ignored in DL-based classifiers, and that a feature engineering approach combining protocol-aware features with neural networks outperforms raw byte ingestion approaches substantially.

Abstract detection

A novel LSTM + CNN architecture achieves 95% service classification accuracy on a real-world ISP and mobile operator dataset using less raw traffic and fewer parameters than prior approaches, outperforming the state-of-the-art by nearly 50% fewer false classifications.

Abstract detection

The proposed model achieves 99% overall accuracy on a public QUIC dataset with fine-grained application-level labeling, demonstrating that QUIC-based encrypted traffic is highly susceptible to ML classification despite its encryption.

Abstract detection

Existing deep learning traffic classifiers, despite having millions of parameters, implement relatively simple logic based on TLS handshake header fields, which limits their robustness when encrypted protocols evolve to new versions. The paper identifies this as a fundamental limitation of the current state of encrypted traffic classification.

Abstract detection

TLS ClientHello length-field permutation tests show that GFW II's parsing behavior matches an older tagged version of TSG's SSL module, while Kazakhstan and Pakistan (DROP mode) exhibit parsing behaviors consistent with TSG QUIC plugin deployments. QUIC version fingerprinting further confirms Kazakhstan runs an older version of TSG's QUIC parsing code, and Myanmar's supported QUIC versions exactly match TSG's, spanning at least five countries confirmed or plausibly running TSG components.

2026-ablove-technical-analysis-geedge §6.4, §6.5, Table 8, Table 9 dpitls-fingerprinthttp3-quic-blocksni-blocking

sing-box 1.14 enables Chrome QUIC fingerprint simulation for Hysteria2 by default, but the release notes explicitly warn that servers using Ed25519 certificates will experience handshake failure when this option is active, requiring operators to disable the fingerprint option or switch certificate algorithms.

2026-anon-gpt-6-astra §sing-box 1.14 tls-fingerprinthttp3-quic-block

Under simultaneous adversarial forgery of both the TLS handshake fingerprint surface and the flow-behavior surface, all multi-view fusion configurations collapse to approximately 0.07 F1 — well below the trivial always-positive baseline of 0.711 (Δ = 0.590, cluster-bootstrap p < 0.001 over 2,000 resamples of 62 captures). Clean-condition model ranking does not predict adversarial ranking.

2026-nguyen-huu-multi-view-fusion-encrypted §V-E tls-fingerprinttraffic-shapeml-classifier

Computing frequency encoding of JA3, JA3S, and SNI across the entire dataset rather than within each cross-validation fold inflates the TLS-view F1 score by 0.28 — approximately ten times larger than any real detection effect measured in the study. When leakage is controlled, the largest genuine multi-view fusion gain over the best single view is only 0.022 F1.

2026-nguyen-huu-multi-view-fusion-encrypted §V-A, Abstract tls-fingerprintml-classifier

Russia's Ministry of Digital Development issued guidelines effective April 15, 2026 requiring popular apps to detect and restrict access from VPN-using devices. RKS Global's analysis of 30 popular Russian Android apps found that 22 of 30 implement VPN detection, and 19 of those transmit the detected VPN status to their servers. This represents a shift from network-layer blocking (TSPU) to app-layer enforcement as an additional censorship vector.

2026-rks-russian-apps-vpn-detection §3, §4 tls-fingerprintml-classifier

The RKS Global report documents a two-tier Russian censorship architecture: TSPU network-layer blocking (documented by Xue et al. 2024) at the ISP level, now supplemented by mandated app-layer VPN detection in the 30 most popular Russian Android apps. This layered approach means a circumvention tool that successfully bypasses TSPU at the network layer can still be detected and reported by the app layer, closing the gap that network-only circumvention leaves open.

2026-rks-russian-apps-vpn-detection §2, §7 tls-fingerprintml-classifiermiddlebox-interference