← 研踪 PaperTrailarXiv:2611.15019 · v1
obfsgen: Generative Tunnel Obfuscation
首次提交 2026-11-11 12:23
版本更新 2026-11-11 12:23
雷达观测 2026-11-13 10:09
摘要
Encrypted tunnels are widely used to circumvent censorship, which has drawn censors' efforts to detect and block them. As the circumvention tunnels in widest use have largely converged on TLS, detection has shifted from the content of their traffic to its shape, where recent research and real-world blocking events have revealed exploitable fingerprints of tunneling. Existing traffic-shaping obfuscators such as obfs4, however, are fundamentally limited in hiding these fingerprints, as their application-driven design can only add to the shape that the application creates. A schedule-driven obfuscator, which decides when and how much to send independently of the application, can give tunnels any shape but raises new challenges, first and foremost what a good shape is. This paper presents obfsgen, a schedule-driven obfuscator for tunneling traffic. obfsgen samples its schedule from a generative sequence model of normal traffic, which predicts the future shape of a flow from its whole history, to capture the long-range dependencies that make a flow's shape normal. Built around this model, obfsgen addresses system problems that such an obfuscator faces in practice, such as synchronization across a noisy network. We evaluate the (in)distinguishability that obfsgen offers, the performance overhead that it adds and the computational resources that it requires. We see the schedule-driven architecture as the next generation of tunnel obfuscators, and we hope that obfsgen and the rationale behind its design help make such obfuscators practical and deployable.
作者备注：Preprint, 19 pages, 13 figures
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-11 12:23 · 最新观测版本
obfsgen: Generative Tunnel Obfuscation
Encrypted tunnels are widely used to circumvent censorship, which has drawn censors' efforts to detect and block them. As the circumvention tunnels in widest use have largely converged on TLS, detection has shifted from the content of their traffic to its shape, where recent research and real-world blocking events have revealed exploitable fingerprints of tunneling. Existing traffic-shaping obfuscators such as obfs4, however, are fundamentally limited in hiding these fingerprints, as their application-driven design can only add to the shape that the application creates. A schedule-driven obfuscator, which decides when and how much to send independently of the application, can give tunnels any shape but raises new challenges, first and foremost what a good shape is. This paper presents obfsgen, a schedule-driven obfuscator for tunneling traffic. obfsgen samples its schedule from a generative sequence model of normal traffic, which predicts the future shape of a flow from its whole history, to capture the long-range dependencies that make a flow's shape normal. Built around this model, obfsgen addresses system problems that such an obfuscator faces in practice, such as synchronization across a noisy network. We evaluate the (in)distinguishability that obfsgen offers, the performance overhead that it adds and the computational resources that it requires. We see the schedule-driven architecture as the next generation of tunnel obfuscators, and we hope that obfsgen and the rationale behind its design help make such obfuscators practical and deployable.
查看此版本解读 →查看此版本原文 ↗