Network measurement methods for locating and examining censorship devices
Network measurement methods for locating and examining censorship devices
复制标题
用于定位和检查审查设备的网络测量方法
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Roya Ensafi
中科院分区：
文献类型：
--
作者：
R. Raman;Mona Wang;Jakub Dalek;Jonathan R. Mayer;Roya Ensafi
网络和防火墙技术的进步导致了网络审查设备的出现，这些设备可以执行大规模，高性能的内容阻止。虽然这样的设备已经激增，但定位、识别和理解它们的技术仍然有限，需要繁琐的手动工作，并且是在个案基础上开发的。在本文中，我们构建了强大的通用方法来了解审查设备的各个方面，并研究了部署在4个国家（阿塞拜疆，白俄罗斯，哈萨克斯坦和俄罗斯）的设备。我们开发了一个审查traceroute方法，CenTrace，自动识别审查设备的网络位置。我们使用横幅抓取来识别潜在审查设备的供应商。为了收集更多关于设备本身的功能，我们构建了一个审查模糊器CenFuzz，它使用各种HTTP请求和TLS客户端Hello模糊策略来检查审查设备的规则和触发器。最后，我们使用使用这些方法收集的功能来集群审查设备，并探索跨部署的设备特征。使用CenTrace测量，我们发现，审查设备往往部署在ISP上游的客户端，有时甚至在其他国家。使用来自横幅抓取和注入块页面的数据，我们确定了阿塞拜疆，白俄罗斯，哈萨克斯坦和俄罗斯的23个商业审查设备部署。我们观察到某些CenFuzz策略，例如使用不同的HTTP方法，成功地规避了大部分这些审查设备，并观察到相同供应商制造的设备使用集群具有类似的规避行为。本文中开发的方法一致且快速地适用于各种审查设备，并使人们能够持续了解和监测世界各地的审查设备。
Advances in networking and firewall technology have led to the emergence of network censorship devices that can perform large-scale, highly-performant content blocking. While such devices have proliferated, techniques to locate, identify, and understand them are still limited, require cumbersome manual effort, and are developed on a case-by-case basis. In this paper, we build robust, general-purpose methods to understand various aspects of censorship devices, and study devices deployed in 4 countries (Azerbaijan, Belarus, Kazakhstan, and Russia). We develop a censorship traceroute method, CenTrace, that automatically identifies the network location of censorship devices. We use banner grabs to identify vendors from potential censorship devices. To collect more features about the devices themselves, we build a censorship fuzzer, CenFuzz, that uses various HTTP request and TLS Client Hello fuzzing strategies to examine the rules and triggers of censorship devices. Finally, we use features collected using these methods to cluster censorship devices and explore device characteristics across deployments. Using CenTrace measurements, we find that censorship devices are often deployed in ISPs upstream to clients, sometimes even in other countries. Using data from banner grabs and injected block-pages, we identify 23 commercial censorship device deployments in Azerbaijan, Belarus, Kazakhstan, and Russia. We observe that certain CenFuzz strategies such as using a different HTTP method succeed in evading a large portion of these censorship devices, and observe that devices manufactured by the same vendors have similar evasion behavior using clustering. The methods developed in this paper apply consistently and rapidly across a wide range of censorship devices and enable continued understanding and monitoring of censorship devices around the world.
登录
查看更多内容
即使是审查机构也有备份：检查中国的双重 HTTPS 审查中间盒
DOI：
10.1145/3473604.3474559
发表时间：
2021
期刊：
Workshop on Free and Open Communications on the Internet (WOOT
影响因子：
--
作者：
Bock, Kevin;Naval, Gabriel;Reese, Kyle;Levin, Dave
通讯作者：
Levin, Dave
DOI：
10.1109/sp40000.2020.00014
发表时间：
2019-07
期刊：
2020 IEEE Symposium on Security and Privacy (SP)
影响因子：
--
作者：
Arian Akhavan Niaki;Shinyoung Cho;Zachary Weinberg;Nguyen Phong Hoang;Abbas Razaghpanah;Nicolas Christin;Phillipa Gill
通讯作者：
Arian Akhavan Niaki;Shinyoung Cho;Zachary Weinberg;Nguyen Phong Hoang;Abbas Razaghpanah;Nicolas Christin;Phillipa Gill
DOI：
--
发表时间：
2022
期刊：
--
影响因子：
--
作者：
Michael Harrity;Kevin Bock;Frederick Sell;Dave Levin
通讯作者：
Michael Harrity;Kevin Bock;Frederick Sell;Dave Levin
TSPU：俄罗斯的去中心化审查制度
DOI：
10.1145/3517745.3561461
发表时间：
2022
期刊：
ACM Internet Measurement Conference
影响因子：
--
作者：
Xue, Diwen;Mixon-Baca, Benjamin;ValdikSS;Ablove, Anna;Kujath, Beau;Crandall, Jedidiah R.;Ensafi, Roya
通讯作者：
Ensafi, Roya