Disguiser

Internet censorship has been widely witnessed and its severity varies from country to country. Such information control, typically placed by authority entities such as governments, ISPs, or organizations, can be achieved by various techniques such as IP-layer censorship (e.g., blocking IP addresses) and application-layer censorship (e.g., domain names based blocking in DNS, HTTP, and HTTPS).

To detect censorship activities in a country, the basic idea is to send a request from a vantage point within the country and then compare the corresponding response with a valid response returned by a legitimate server. The dilemma here is that if the request is censored, the vantage point has no ground truth to automatically validate the legitimate response. To tackle this issue, existing studies typically collect and validate the responses from nodes deployed in multiple countries. However, this approach inevitably reduces the detection reliability due to the diversity and flexibility of Internet services. Clients at diverse locations may obtain different but valid IP addresses for the same domain, and websites may intentionally restrict their services on certain locations or offer different content to the clients from different locations. Thus, manual inspection is usually needed, causing the analysis unscalable and inefficient. More importantly, manual analysis can only identify false positives (i.e., misclassified censorship) but false negatives (i.e., undetected censorship) remain uncountable in the state-of-the-art studies.

Approach. The objective of this proposed research is to detect censorship activities and understand the impact of censorship activities, while effectively eliminating or minimizing false cases without manual inspection. The high-level idea is that a client instructs the vantage points to (1) craft DNS/HTTP/HTTPS requests with the test domain names embedded, (2) send the packets to our control server to trigger censorship, and (3) collect the response back for later analysis. Our control server replies to arbitrary requests with a static payload for each type of protocol. Note that we do not send any requests to legitimate servers, and the accessed domains in the requests (if being censored) would still trigger the censorship since the censor devices will see the undesired domains but have no knowledge whether the destination IP address is associated with a legitimate server of the censored domain. In the end, this provides us a baseline by controlling what should be expected at the client side when no censorship is involved so as to accurately recognize the censorship activities.

Relevant Papers

Lin Jin, Shuai Hao, Haining Wang, and Chase Cotton. Understanding the Practices of Global Censorship through Accurate, End-to-End Measurements, in ACM SIGMETRICS, June 2022.

Lin Jin, Shuai Hao, Haining Wang, and Chase Cotton. Understanding the Impact of Encrypted DNS on Internet Censorship, in The Web Conference (WWW), April 2021.