The Tor behavior detection collection configured all Tor clients to use Snowflake bridges, meaning the dataset's 'Tor' label class captures Snowflake-tunneled Tor traffic. A classifier trained on these flows would associate the Snowflake WebRTC signaling and DTLS/SRTP profile with the Tor-Normal classification boundary.

TrafficInstruct evaluates majority-class, random-forest, ET-BERT, an unadapted 27B language model (Qwen3.8-27B), and task-specific LoRA adapters (trained 10 epochs, batch 32, lr 2×10⁻⁵, max 512 tokens) on a shared frozen base across ten traffic classification tasks including VPN detection, Tor behavior detection, and website fingerprinting; task-specific adaptation improves Macro-F1 over the unadapted 27B baseline on all tasks.

§V-A, Abstract evaluation

The malicious DNS-over-HTTPS detection task classifies iodine, dns2tcp, and dnscat2 tunnel traffic across 12 scripted behaviors (heartbeats, polling, staged uploads, bidirectional sessions, large transfers) using 166 statistical features per bidirectional flow extracted by a fixed feature extractor without a configured packet-count threshold (13 packets is a reported observed minimum, not an admission gate).

§III-A (task 3) detection

TrafficInstruct's encrypted VPN and Tor behavior detection tasks use flow-level features (packet lengths, directions, relative times, header fields) while explicitly omitting SNI, domain names, endpoint identifiers, and raw payloads. This demonstrates that VPN and Tor traffic can be classified into 18 and 12 activity categories respectively using statistical features alone, without application-layer identifiers.

§IV-A, §IV-D detection

The website fingerprinting task identifies 50 monitored HTTPS websites from Chromium visit Traces using inter-packet intervals and direction-encoded IP-packet lengths (up to 512 packet events and 128 bursts per trace), distinguishing monitored sites from visits to 100 unknown domains. Summary statistics over the complete trace supplement the truncated event sequence.

§III-A (task 9), §IV-A detection

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

The BiFEP datastream construction uses a 'wrapper' layer with authenticated DATA, DUMMY, and FIN frames over an independently keyed inner FEP per direction, revealing only a public sending schedule ΓX(t) and quantized closing epoch from the set Ecl — the exact private half-close time is hidden behind continued cover traffic. Empirical passive diagnostics on the Rust implementation show byte entropy of 7.999279–7.999749 bits/byte, maximum absolute byte correlation of 0.004668, and a random-forest ROC-AUC of 0.485 (95% CI [0.428, 0.542]) distinguishing DATA from ChaCha20 — not significantly better than chance.

2026-chen-closing-loop-bidirectional §IV; §VIII-D, Table IV fully-encrypted-detecttraffic-shapeml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier