Adding nine beacon descriptors (inter-arrival-time moments, FFT peak period and power, flow count per endpoint triple, idle ratio) to the flow-statistics view improves Random Forest F1 from 0.747 to 0.856 (+0.109) — one order of magnitude larger than any multi-view fusion gain (+0.022). However, the top-weighted feature beacon_n_flows correlates with capture length (Spearman ρ = 0.718) and its single-feature ROC-AUC varies from 0.173 to 0.977 across folds, indicating it partly reflects a collection artifact rather than real beacon periodicity.

Under simultaneous adversarial forgery of both the TLS handshake fingerprint surface and the flow-behavior surface, all multi-view fusion configurations collapse to approximately 0.07 F1 — well below the trivial always-positive baseline of 0.711 (Δ = 0.590, cluster-bootstrap p < 0.001 over 2,000 resamples of 62 captures). Clean-condition model ranking does not predict adversarial ranking.

§V-E detection

Computing frequency encoding of JA3, JA3S, and SNI across the entire dataset rather than within each cross-validation fold inflates the TLS-view F1 score by 0.28 — approximately ten times larger than any real detection effect measured in the study. When leakage is controlled, the largest genuine multi-view fusion gain over the best single view is only 0.022 F1.

§V-A, Abstract evaluation

Forging the TLS handshake surface (JA3/JA3S fingerprint, certificate, ALPN, HTTP/2 negotiation) requires only minutes via malleable profile configuration, while forging flow-behavior features (inter-arrival timing, packet-size distribution, volume statistics) requires sleep/jitter tuning and cover traffic but remains feasible. The paper explicitly rejects the common assumption that flow behavior cannot be forged.

§III defense

The apparent 55.1% positive rate in a 17,577-flow Cobalt Strike corpus is an artifact of counting individual flows rather than endpoints: those flows reduce to only 2,132 independent endpoint groups, where the true positive rate is 4.2%. No endpoint triple carries a mixed label, so flows sharing a destination are not independent observations and standard deviations computed at flow level are artificially small.

§V-A, Table II evaluation

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

The BiFEP datastream construction uses a 'wrapper' layer with authenticated DATA, DUMMY, and FIN frames over an independently keyed inner FEP per direction, revealing only a public sending schedule ΓX(t) and quantized closing epoch from the set Ecl — the exact private half-close time is hidden behind continued cover traffic. Empirical passive diagnostics on the Rust implementation show byte entropy of 7.999279–7.999749 bits/byte, maximum absolute byte correlation of 0.004668, and a random-forest ROC-AUC of 0.485 (95% CI [0.428, 0.542]) distinguishing DATA from ChaCha20 — not significantly better than chance.

2026-chen-closing-loop-bidirectional §IV; §VIII-D, Table IV fully-encrypted-detecttraffic-shapeml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier