Network measurement methods for locating and examining censorship devices

Raman, Ram Sundara; Wang, Mona; Dalek, Jakub; Mayer, Jonathan; Ensafi, Roya

doi:10.1145/3555050.3569133

Cited by 3 publications

(1 citation statement)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We confirm our findings from multiple angles, including previous country-specific studies on Internet censorship [8], [21], [34], [51], [52], [63], [72], [72], [76], [85], [92], [92], OONI reports [55], and OONI's globally-collected data. OONI provides volunteers with the flexibility to customize their domain test list and provide a default test list (the Citizen Lab Test list [43]) if the volunteers opt in.…”

Section: B Persistent Blocking Within Ispssupporting

confidence: 90%

Modeling and Detecting Internet Censorship Events

Tsai,

Raman,

Prakash

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Publicly accessible censorship datasets, such as OONI and Censored Planet, provide valuable resources for understanding global censorship events. However, censorship event detection in these datasets is challenging due to the overwhelming amount of data, the dynamic nature of censorship, and potentially heterogeneous blocking policies across networks in the same country. This paper presents CenDTect, an unsupervised learning system based on decision trees that overcomes the scalability issue of manual analysis and the interpretability issues of previous timeseries methods. CenDTect employs iterative parallel DBSCAN to identify domains with similar blocking patterns, using an adapted cross-classification accuracy as the distance metric. The system analyzes more than 70 billion data points from Censored Planet between January 2019 and December 2022, discovering 15,360 HTTP(S) event clusters in 192 countries and 1,166 DNS event clusters in 77 countries. By evaluating CenDTect's findings with a curated list of 38 potential censorship events from news media and reports, we show how all events confirmed by the manual inspection are easy to characterize with CenDTect's output. We report more than 100 ASes in 32 countries with persistent ISP blocking. Additionally, we identify 11 temporary blocking events in clusters discovered in 2022, observed during periods of election, political unrest, protest, and war. Our approach provides informative and interpretable outputs, making censorship data more accessible to data consumers including researchers, journalists, and NGOs.

show abstract

Section: B Persistent Blocking Within Ispssupporting

confidence: 90%

Modeling and Detecting Internet Censorship Events

Tsai,

Raman,

Prakash

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

Poster: Circumventing the GFW with TLS Record Fragmentation

Niere,

Hebrok,

Somorovsky

et al. 2023

Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Yarrpbox: Detecting Middleboxes at Internet-Scale

Hilal,

Gasser

2023

Proc. ACM Netw.

View full text Add to dashboard Cite

The end-to-end principle is one of the foundations of the original Internet architecture. This principle is put to the test by middleboxes, i.e., devices which change important parts of a packet in transit. Middleboxes can have beneficial effects, such as a lower handshake time, but also make it more difficult to deploy newly developed protocols, such as TLS 1.3 and QUIC. Therefore, it is important to have a good understanding of the middlebox ecosystem in the Internet. In this paper, we present results from a multi-faceted middlebox analysis study. We develop Yarrpbox, a tool to efficiently perform middlebox detection measurements on an Internet-scale. With Yarrpbox, we perform IPv4-wide middlebox detection and find that nearly 10% of paths are affected by a total of 5.8k middlebox devices. We perform the first IPv6 study to date, uncovering a lower prevalence of middleboxes in IPv6. Moreover, we show that the location of a vantage point can have an effect on the results, leading to up to 600 more detected middleboxes. Additionally, we characterize middleboxes by mapping them to vendors and resolving aliases. Finally, we release Yarrpbox as open-source software and make data and analysis code publicly available.

show abstract

Network measurement methods for locating and examining censorship devices

Cited by 3 publications

References 33 publications

Modeling and Detecting Internet Censorship Events

Modeling and Detecting Internet Censorship Events

Poster: Circumventing the GFW with TLS Record Fragmentation

Yarrpbox: Detecting Middleboxes at Internet-Scale

Contact Info

Product

Resources

About