IMR: MT: A Tool for Passively Measuring Internet Censorship

全世界有数十亿人生活在对互联网流量进行自动审查和其他形式的流量篡改的地区。了解用户如何受到这种审查制度的影响，对于制定促进更自由和开放地获取信息的技术和政策至关重要。之前衡量互联网审查制度的努力主要集中在主动衡量上，这包括获取有利位置，然后从域名或关键字的测试列表中发出查询，以确定哪些域名或关键字在哪里受到审查。虽然这些努力被证明是无价的，但仅依靠主动测量就施加了几个限制，其中最主要的是它们只能测量可能被审查的内容，而不是用户正在积极体验的内容。该项目的新奇之处是一组测量工具的集合，当审查发生在真实用户的互联网流量时，这些工具可以被动地检测审查。该项目更广泛的意义和重要性在于，它允许收集仅靠主动测量无法收集的数据集；拟议中的项目的被动技术可以快速检测新审查的内容，并捕捉用户正在积极体验的内容。该项目背后的核心见解是，审查可以通过“篡改签名”来检测：这是第三方篡改流量的迹象，例如可疑的连接中断数据包或对未加密查询的重复响应。该项目按照不同的部署方案组织，每个方案在检测篡改签名时都会带来独特的技术挑战：一个用于服务器端部署的定制测量工具，一个用于客户端部署，一个用于网络内部署(如在互联网服务提供商)。这一系列测量工具预计将允许在世界各地许多不同的有利位置进行审查测量。因此，该项目还在开发允许多个网络安全和负责任地共享数据的技术。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Billions of people worldwide live in regions that perform automated censorship of Internet traffic and other forms of traffic tampering. Understanding how users are affected by such censorship is of critical importance in developing technologies and policies that promote more free and open access to information. Prior efforts to measure Internet censorship have focused on active measurements, which involve procuring vantage points and then issuing queries from a test-list of domain names or keywords to determine what is being censored where. While these efforts have proven invaluable, relying on active measurements alone imposes several limitations, chief among them being that they can only measure what could be censored, not what users are actively experiencing. This project's novelties are a collection of measurement tools that passively detect censorship as it occurs with real users' Internet traffic. The project's broader significance and importance are that it allows datasets to be collected that are not possible with active measurements alone; the proposed project's passive techniques can rapidly detect newly censored content, and they capture what users are actively experiencing.The central insight behind the project is that censorship can be detected through "tamper signatures": tell-tale signs of traffic tampering by a third party, such as suspiciously timed connection tear-down packets or duplicate responses to unencrypted queries. The project is organized along different deployment scenarios that each raise unique technical challenges when detecting tamper signatures: a customized measurement tool for server-side deployments, one for client-side deployments, and one for in-network deployments (such as at an Internet Service Provider). This collection of measurement tools is expected to permit censorship measurements at many disparate vantage points around the world. The project is thus also developing techniques that will allow multiple networks to share their data safely and responsibly.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.