Cross-layer RTTs Fingerprinting Proxy Traffic

The Discriminative Power of Cross-layer RTTs in Fingerprinting Proxy Traffic

· 3 min · 663 words

topic/papercomputer science/securitycomputer science/networkingcomputer science/censorship

Paper Summary | NDSS 2025 | Generated by Hermes Agent

Executive Summary: This paper reveals a protocol-agnostic fingerprint for detecting obfuscated circumvention proxy traffic: the misalignment of transport-layer and application-layer Round-Trip Times (RTTs) caused by proxy routing. Because transport-layer sessions break at the proxy while application-layer sessions remain end-to-end, the RTTs across these layers diverge — creating a detectable RTT_diff signal. Tested across 8 geographic locations with controlled and real ISP traffic, ~80% of domains visited via obfuscated proxies generate detectable RTT discrepancy, with half of detections made within the first 60 packets of a flow. This timing-based fingerprint threatens ALL proxy protocols simultaneously and cannot be mitigated by existing payload-based obfuscation.

1. High-Level Overview

This paper addresses the circumvention arms race: censors deploy increasingly sophisticated methods to detect and block proxy/VPN traffic, while developers create new obfuscation schemes to evade detection. The authors identify a fundamental, protocol-agnostic vulnerability: packet timing.

The core insight: when a client uses a proxy, the transport-layer session (TCP) terminates at the proxy, but the application-layer session (TLS) extends end-to-end from client to server. These layers traverse different network paths with different RTTs. The discrepancy (RTT_diff = |transport_RTT - application_RTT|) serves as a reliable fingerprint for proxy detection.

2. Problem Statement

Existing circumvention detection focuses on protocol-specific features (packet sizes, cipher suites, payload patterns). Each new obfuscation scheme forces censors to develop new classifiers. But all proxy protocols share the same architectural property: transport and application sessions terminate at different endpoints, creating RTT misalignment. This is a cross-protocol side channel that cannot be patched by modifying payload characteristics.

3. Core Approach

RTT Estimation

  • Transport-layer RTT: Estimated via TCP handshake timing (SYN → SYN/ACK); terminates at proxy
  • Application-layer RTT: Estimated via TLS handshake timing (ClientHello → ServerHello); extends end-to-end through proxy
  • RTT_diff = difference between these two measurements

Detection via Sequential Hypothesis Testing (SHT)

  • Frame the problem as: given observed RTT_diff, is the connection direct or proxied?
  • SHT allows early termination — most detections within 60 packets
  • Requires only passive monitoring (no active probing)

4. Evaluation Results

  • 8 geographic locations tested (US, Europe, Asia, Middle East)
  • 80% of domains visited via obfuscated proxy generate detectable RTT_diff
  • 50% of detections made within the first 60 packets of a flow
  • False Positive Rate (FPR) comparable to deployed censorship attacks
  • Protocol-agnostic — tested against multiple obfuscation schemes (Shadowsocks, V2Ray, Obfs4, etc.)
  • CDN presence complicates detection but doesn’t eliminate the fingerprint

5. Key Findings

  1. RTT_diff is inherent to proxy architecture — no obfuscation scheme can eliminate it without fundamentally redesigning how proxies work
  2. Timing-based, not payload-based — existing countermeasures (padding, cipher randomization) are ineffective
  3. Scalable — a single classifier works against ALL proxy protocols simultaneously
  4. Passive — censor doesn’t need to actively probe; can monitor traffic silently
  5. Early detection — most flows are classified within the first few dozen packets

6. Limitations

  • CDNs and anycast routing can introduce natural RTT variance (false positives)
  • Client-proxy RTT and proxy-server RTT can coincidentally match (false negatives)
  • Requires on-path vantage point (ISP-level censor)
  • DNS resolution handling affects measurements

7. Countermeasures

  • Decouple transport and application layers — make them terminate at the same endpoint
  • Introduce artificial delays to normalize RTTs across layers (at cost of performance)
  • Multi-hop proxies to blur the RTT boundaries

8. TL;DR

Proxy routing creates a natural mismatch between transport-layer RTT (client↔proxy) and application-layer RTT (client↔server). This RTT_diff is a protocol-agnostic fingerprint detectable within 60 packets for ~80% of proxied flows, threatening ALL circumvention tools simultaneously. Payload obfuscation cannot fix it — only architectural changes to proxy design can.

Sources

  1. NDSS 2025 Paper (DOI): https://dx.doi.org/10.14722/ndss.2025.240966
  2. Paper Page: https://www.ndss-symposium.org/ndss-paper/the-discriminative-power-of-cross-layer-rtts-in-fingerprinting-proxy-traffic/
  3. Authors: Diwen Xue, Robert Stanley, Piyush Kumar, Roya Ensafi — University of Michigan