Using the CBOR-based DNS format (application/dns+cbor) reduces DNS message sizes — CBOR DNS queries are at most 136 bytes versus classic DNS queries at 83 bytes for the 99th percentile — but smaller, more uniform packet sizes inadvertently improve classifier accuracy for DNS frame identification, counteracting obfuscation. Reducing packet size and reducing detectability are conflicting goals in packet-format obfuscation.

CBOR-based DNS encoding (application/dns+cbor) reduces DNS message sizes—CBOR DNS queries max out at 136 bytes vs. 150 bytes for classic DNS, and responses at 388 bytes vs. 498 bytes—but paradoxically makes DoC traffic easier to identify within CoAP data, because smaller, more distinctive message sizes create a more separable feature distribution for classifiers.

§2 / §6 defense

DNS over CoAP with equalized packet lengths (64-byte block-wise transfer) and SCHC header compression reduces Random Forest classification accuracy for identifying DNS frames from a ~89% baseline to 86%; adding payload compression (application/dns+cbor) further reduces accuracy to 77%. This outperforms DNS over HTTPS in constrained IoT settings across 296 evaluated deployment scenarios.

Abstract / §5–6 evaluation

DNS over HTTPS traffic is always identifiable by ML classifiers based solely on IP addresses, regardless of encryption strength. Because DoH servers have fixed, well-known IP addresses distinct from data servers, classifiers achieve near-perfect accuracy on DoH without inspecting payload content.

§6.2 (header field analysis) / Abstract detection

In DNS over HTTPS deployments evaluated across all constrained IoT scenarios, classifiers achieve near-perfect accuracy identifying DNS frames based on IP address features alone — TLS encryption does not prevent DNS traffic identification when the DNS server IP is distinct from data server IPs. DoH provides weaker DNS traffic obfuscation than well-configured DoC in IoT deployments.

Abstract / §6 detection

Using a peer-based SCHC rule set — where the device ID is the XOR of source and destination link-layer addresses rather than just the device address — allows a single rule ID to serve multiple destinations and enables eliding (rather than merely compressing) flow-identifying header fields including IPv6 prefix, device IID, and CoAP Uri-Host. This prevents the rule ID itself from becoming a per-destination flow identifier observable to an eavesdropper.

§2 / §6.3 defense

Among six ML classifiers evaluated via 5-fold cross-validation across 296 IoT DNS deployment scenarios, Random Forest (RF) consistently achieved the highest accuracy (~0.891), precision (~0.864), recall (~0.813), and F1 score (~0.831). All six classifiers (LR, KNN, SVM, DT, RF, AB) achieved accuracies between 0.826 and 0.891, indicating that DNS-vs-data classification is robust to classifier choice.

§5 evaluation

In SCHC header compression, even a compact rule ID (8 bits in the paper's configuration) can function as a persistent flow identifier, leaking the per-device communication pattern to an eavesdropper. Standard per-device SCHC rule assignments allow an adversary to associate rule IDs with individual constrained IoT devices across sessions.

§2 / §6.3 detection

Adding artificial inter-arrival time delays — a standard DNS obfuscation technique in unconstrained networks — is infeasible for constrained IoT devices due to long inherent delays and high packet loss rates on constrained wireless links; the paper explicitly excludes timing-based obfuscation for this reason. EDNS(0) padding at recommended multiples of 128 bytes similarly inflates packet sizes to the point of forcing fragmentation, multiplying loss in constrained networks.

§1 / §3.1 evaluation

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score distinguishing watermarked from natural Tor flows, and a 97.5% macro-F1 score for fine-grained modulation classification across sinusoidal, square-wave, and triangular patterns. The fine-grained test set contains 201 held-out samples collected from ten clients across five geographic regions (Europe, North America, Australia, Southeast Asia, East Asia), with training traces including traffic collected under WTF-PAD and Walkie-Talkie defenses.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III, Table V flow-correlationml-classifiertraffic-shape