IMR: MT: A Tool for Passively Measuring Internet Censorship

全世界有数十亿人生活在对互联网流量进行自动审查和其他形式的流量篡改的地区。 了解用户如何受到这种审查的影响，对于开发促进更自由和开放地获取信息的技术和政策至关重要。 以前衡量互联网审查的努力集中在主动测量上，包括获取Vantage，然后从域名或关键字的测试列表中发出查询，以确定什么在哪里被审查。 虽然这些努力已被证明是非常宝贵的，但仅仅依靠主动测量会带来一些限制，其中最主要的是它们只能测量可能被审查的内容，而不是用户正在积极体验的内容。 这个项目的创新之处是收集了一系列测量工具，这些工具可以被动地检测真实的用户的互联网流量。 该项目更广泛的意义和重要性在于，它允许收集仅通过主动测量无法收集的数据集;拟议项目的被动技术可以快速检测新审查的内容，并捕捉用户正在积极体验的内容。该项目背后的核心见解是，审查可以通过“篡改签名”来检测：流量被第三方篡改的迹象，例如可疑的定时连接拆除数据包或对未加密查询的重复响应。 该项目是按照沿着的不同部署方案组织的，每种方案在检测篡改签名时都提出了独特的技术挑战：一个用于服务器端部署的自定义测量工具，一个用于客户端部署，一个用于网络内部署（例如在Internet服务提供商处）。 这一系列测量工具预计将允许在世界各地的许多不同的Vantage位置进行审查测量。 因此，该项目也在开发技术，使多个网络能够安全和负责任地共享数据。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Billions of people worldwide live in regions that perform automated censorship of Internet traffic and other forms of traffic tampering. Understanding how users are affected by such censorship is of critical importance in developing technologies and policies that promote more free and open access to information. Prior efforts to measure Internet censorship have focused on active measurements, which involve procuring vantage points and then issuing queries from a test-list of domain names or keywords to determine what is being censored where. While these efforts have proven invaluable, relying on active measurements alone imposes several limitations, chief among them being that they can only measure what could be censored, not what users are actively experiencing. This project's novelties are a collection of measurement tools that passively detect censorship as it occurs with real users' Internet traffic. The project's broader significance and importance are that it allows datasets to be collected that are not possible with active measurements alone; the proposed project's passive techniques can rapidly detect newly censored content, and they capture what users are actively experiencing.The central insight behind the project is that censorship can be detected through "tamper signatures": tell-tale signs of traffic tampering by a third party, such as suspiciously timed connection tear-down packets or duplicate responses to unencrypted queries. The project is organized along different deployment scenarios that each raise unique technical challenges when detecting tamper signatures: a customized measurement tool for server-side deployments, one for client-side deployments, and one for in-network deployments (such as at an Internet Service Provider). This collection of measurement tools is expected to permit censorship measurements at many disparate vantage points around the world. The project is thus also developing techniques that will allow multiple networks to share their data safely and responsibly.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.