A longitudinal study of Tor transit dependency from 2015 to 2025 reveals persistent concentration in a small number of transit ASes, indicating that AS-level chokepoints enabling flow-correlation attacks are a structural rather than transient property of the Tor network.

Country-level analysis shows significant sensitivity of AS-level transit dependency to the distribution of relay capacity across ASes within each country, implying that a censor controlling a dominant national transit AS gains disproportionately high visibility into Tor traffic if domestic relay capacity is concentrated in that AS's customer cone.

Abstract evaluation

The authors propose a diversity-aware relay placement heuristic derived from bandwidth-weighted AS Hegemony scores to guide future mitigation of transit concentration. By incorporating consensus bandwidth weighting into hegemony calculations, the methodology reflects actual Tor traffic patterns rather than relay counts alone.

Abstract defense

SURF (AS1103) surged to over 50% exit hegemony in 2024, meaning a single AS gained visibility into the majority of bandwidth-weighted Tor exit traffic. This represents a dramatic concentration event in an otherwise persistent but distributed chokepoint landscape spanning 2015–2025.

Abstract evaluation

A three-stage detection pipeline exploiting the "dual-role" behavioral fingerprint of single-IP circumvention relays achieved 23.2% recall (96/414 ground-truth relays) with a 0.18% false-positive rate against 97,651 benign TLS servers, for an overall accuracy of 99.5%. The ground-truth set covered OpenVPN, WireGuard, and SOCKS relays identified in a 17 TB single-day backbone trace (WIDE Project, April 9, 2025).

2026-almutairi-server §3.4, Table 1 traffic-shapedpiflow-correlation

Brussee measures a systematic pattern of Chinese government websites actively blocking access from outside China (the "reverse Great Firewall"), publishing a CSV dataset of affected domains (available at zenodo.org/records/18172145). The paper frames this outbound geo-blocking as a cybersecurity-motivated practice — Chinese authorities classify foreign access to domestic government infrastructure as an attack surface — distinct from the inbound information control goal of the GFW.

2026-brussee-reverse-great-firewall §3, §5 ip-blockingasn-blackholing

Brussee develops a conceptual framework distinguishing two logics of government geo-blocking: (1) information control (blocking inbound foreign content from domestic users) and (2) data sovereignty / attack-surface reduction (blocking outbound access by foreign actors to domestic systems). Chinese government site blocking of external IPs is motivated primarily by the second logic, creating an asymmetric internet topology where CN citizens cannot reach the outside world, and outside actors cannot probe CN government infrastructure.

2026-brussee-reverse-great-firewall §2, §4 ip-blockingasn-blackholing

AS-targeted shutdowns — where censors restrict connectivity at specific ISPs or autonomous systems rather than imposing country-wide outages — evade country-level aggregation in automated detection systems, which are calibrated to detect national-scope disruptions.

2026-cheek-gaps-record-observability §3 Detection Gap Categories measurement-platformasn-blackholing

The dominant enforcement mechanism in April 2026 was administrative 'reporting + line-cutting' (通报 + 拔线) backed by MIIT bulletins, not protocol-level DPI changes. Operators reported that newly acquired upstream resources were reported to authorities quickly after acquisition, recovery timelines were uncontrollable, and some upstream providers refused refunds after enforcement actions, producing sustained capacity contraction across the shared VPN-reseller ecosystem.

2026-ermao-april-airport-outage §这轮波动到底发生了什么 ip-blockingasn-blackholing

The April 2026 enforcement cycle created a resource-scarcity feedback loop: upstream providers cut lines with no obligation to refund resellers, newly acquired replacement resources can themselves be reported and cut within days, and stable-resource availability windows are described as "越来越短" (increasingly short) while costs rise concurrently. The overall effect is systemic capacity contraction forecast to continue through at least May 2026.

2026-ermao-april-airport-outage §这轮波动到底发生了什么 / §四月后的趋势判断 ip-blockingasn-blackholingthrottling