{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T16:56:18Z","timestamp":1776099378049,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":55,"publisher":"ACM","license":[{"start":{"date-parts":[[2015,10,12]],"date-time":"2015-10-12T00:00:00Z","timestamp":1444608000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Dr. Eric Schmidt","award":["New Digital Age Grant"],"award-info":[{"award-number":["New Digital Age Grant"]}]},{"name":"National Science Foundation","award":["CNS- 1330308"],"award-info":[{"award-number":["CNS- 1330308"]}]},{"name":"National Science Foundation","award":["CNS-1065134"],"award-info":[{"award-number":["CNS-1065134"]}]},{"name":"National Science Foundation","award":["CNS-1319061"],"award-info":[{"award-number":["CNS-1319061"]}]},{"name":"National Science Foundation","award":["CNS-1546033"],"award-info":[{"award-number":["CNS-1546033"]}]},{"name":"National Science Foundation","award":["CNS-0845610"],"award-info":[{"award-number":["CNS-0845610"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2015,10,12]]},"DOI":"10.1145\/2810103.2813715","type":"proceedings-article","created":{"date-parts":[[2015,10,6]],"date-time":"2015-10-06T15:22:12Z","timestamp":1444144932000},"page":"57-69","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":74,"title":["Seeing through Network-Protocol Obfuscation"],"prefix":"10.1145","author":[{"given":"Liang","family":"Wang","sequence":"first","affiliation":[{"name":"University of Wisconsin-Madison, Madison, WI, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kevin P.","family":"Dyer","sequence":"additional","affiliation":[{"name":"Portland State University, Portland, OR, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Aditya","family":"Akella","sequence":"additional","affiliation":[{"name":"University of Wisconsin-Madison, Madison, WI, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Thomas","family":"Ristenpart","sequence":"additional","affiliation":[{"name":"Cornell Tech, New York, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Thomas","family":"Shrimpton","sequence":"additional","affiliation":[{"name":"University of Florida, Gainesville, FL, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2015,10,12]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382208"},{"key":"e_1_3_2_1_2_1","volume-title":"Hive operators and user-defined functions. https:\/\/cwiki.apache.org\/confluence\/display\/Hive\/LanguageManual+UDF","year":"2015","unstructured":"Apache. Hive operators and user-defined functions. https:\/\/cwiki.apache.org\/confluence\/display\/Hive\/LanguageManual+UDF , 2015 . Apache. Hive operators and user-defined functions. https:\/\/cwiki.apache.org\/confluence\/display\/Hive\/LanguageManual+UDF, 2015."},{"key":"e_1_3_2_1_3_1","volume-title":"Pluggable transports for circumvention. https:\/\/www.torproject.org\/docs\/pluggable-transports.html.en","author":"Appelbaum J.","year":"2012","unstructured":"J. Appelbaum and N. Mathewson . Pluggable transports for circumvention. https:\/\/www.torproject.org\/docs\/pluggable-transports.html.en , 2012 . J. Appelbaum and N. Mathewson. Pluggable transports for circumvention. https:\/\/www.torproject.org\/docs\/pluggable-transports.html.en, 2012."},{"key":"e_1_3_2_1_4_1","volume-title":"Free and Open Communications on the Internet","author":"Aryan S.","year":"2013","unstructured":"S. Aryan , H. Aryan , and J. A. Halderman . Internet censorship in iran: A first look . Free and Open Communications on the Internet , Washington, DC, USA , 2013 . S. Aryan, H. Aryan, and J. A. Halderman. Internet censorship in iran: A first look. Free and Open Communications on the Internet, Washington, DC, USA, 2013."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/EUC.2011.76"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1129582.1129589"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382260"},{"key":"e_1_3_2_1_8_1","volume-title":"Detecting FTE proxy","author":"Communeau A.","year":"2014","unstructured":"A. Communeau , P. Quillent , and A. Compain . Detecting FTE proxy . 2014 . A. Communeau, P. Quillent, and A. Compain. Detecting FTE proxy. 2014."},{"key":"e_1_3_2_1_9_1","unstructured":"D. Cournapeau. Scikit-learn: Machine learning in Python. http:\/\/scikit-learn.org\/ 2007.  D. Cournapeau. Scikit-learn: Machine learning in Python. http:\/\/scikit-learn.org\/ 2007."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1143844.1143874"},{"key":"e_1_3_2_1_11_1","volume-title":"DTIC Document","author":"Dingledine R.","year":"2004","unstructured":"R. Dingledine , N. Mathewson , and P. Syverson . Tor: The second-generation onion router. Technical report , DTIC Document , 2004 . R. Dingledine, N. Mathewson, and P. Syverson. Tor: The second-generation onion router. Technical report, DTIC Document, 2004."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516657"},{"key":"e_1_3_2_1_13_1","volume-title":"Proceedings of USENIX Security 2015","author":"Dyer K. P.","year":"2015","unstructured":"K. P. Dyer , S. E. Coull , and T. Shrimpton . Marionette: A programmable network-traffic obfuscation system . In Proceedings of USENIX Security 2015 , August 2015 . K. P. Dyer, S. E. Coull, and T. Shrimpton. Marionette: A programmable network-traffic obfuscation system. In Proceedings of USENIX Security 2015, August 2015."},{"key":"e_1_3_2_1_14_1","unstructured":"Eugene. Age of surveillance: the fish is rotting from its head. http:\/\/non-linear-response.blogspot.com\/2011\/01\/age-of-surveillance-fish-is-rotting.html 2011.  Eugene. Age of surveillance: the fish is rotting from its head. http:\/\/non-linear-response.blogspot.com\/2011\/01\/age-of-surveillance-fish-is-rotting.html 2011."},{"key":"e_1_3_2_1_15_1","volume-title":"https:\/\/github.com\/strongloop\/express\/issues\/1816","author":"POST","year":"2013","unstructured":"Hill01. \"Weird\" utf-8 characters in POST body causing content-length mismatch. https:\/\/github.com\/strongloop\/express\/issues\/1816 , 2013 . Hill01. \"Weird\" utf-8 characters in POST body causing content-length mismatch. https:\/\/github.com\/strongloop\/express\/issues\/1816, 2013."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.14"},{"key":"e_1_3_2_1_17_1","unstructured":"ISO. 171\/sc 2: Iso 32000--1: 2008 document management-portable document format-part 1: Pdf 1.7.  ISO. 171\/sc 2: Iso 32000--1: 2008 document management-portable document format-part 1: Pdf 1.7."},{"key":"e_1_3_2_1_18_1","unstructured":"E. Jones T. Oliphant P. Peterson etal SciPy: Open source scientific tools for Python. http:\/\/www.scipy.org\/ 2001.  E. Jones T. Oliphant P. Peterson et al. SciPy: Open source scientific tools for Python. http:\/\/www.scipy.org\/ 2001."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660368"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1090191.1080119"},{"key":"e_1_3_2_1_21_1","unstructured":"K. H. Kremer. The trouble with the XREF table. http:\/\/khkonsulting.com\/2013\/01\/the-trouble-with-the-xref-table\/ 2013.  K. H. Kremer. The trouble with the XREF table. http:\/\/khkonsulting.com\/2013\/01\/the-trouble-with-the-xref-table\/ 2013."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00008-0"},{"key":"e_1_3_2_1_23_1","volume-title":"https:\/\/github.com\/brl\/obfuscated-openssh","author":"Leidl B.","year":"2009","unstructured":"B. Leidl . Obfuscated-openssh. https:\/\/github.com\/brl\/obfuscated-openssh , 2009 . B. Leidl. Obfuscated-openssh. https:\/\/github.com\/brl\/obfuscated-openssh, 2009."},{"key":"e_1_3_2_1_24_1","volume-title":"Proceedings of USENIX Security 2014","author":"Luchaup D.","year":"2014","unstructured":"D. Luchaup , K. P. Dyer , S. Jha , T. Ristenpart , and T. Shrimpton . LibFTE: A toolkit for constructing practical, format-abiding encryption schemes . In Proceedings of USENIX Security 2014 , August 2014 . D. Luchaup, K. P. Dyer, S. Jha, T. Ristenpart, and T. Shrimpton. LibFTE: A toolkit for constructing practical, format-abiding encryption schemes. In Proceedings of USENIX Security 2014, August 2014."},{"key":"e_1_3_2_1_25_1","volume-title":"Invalid content-length header may cause requests to fail through ISA server. https:\/\/support.microsoft.com\/en-us\/kb\/300707","year":"2007","unstructured":"Microsoft. Invalid content-length header may cause requests to fail through ISA server. https:\/\/support.microsoft.com\/en-us\/kb\/300707 , 2007 . Microsoft. Invalid content-length header may cause requests to fail through ISA server. https:\/\/support.microsoft.com\/en-us\/kb\/300707, 2007."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382210"},{"key":"e_1_3_2_1_27_1","first-page":"369","volume-title":"Proceedings 2006 31st IEEE Conference on","author":"Nguyen T. T.","year":"2006","unstructured":"T. T. Nguyen and G. Armitage . Training on multiple sub-flows to optimise the use of machine learning classifiers in real-world ip networks. In Local Computer Networks , Proceedings 2006 31st IEEE Conference on , pages 369 -- 376 . IEEE, 2006 . T. T. Nguyen and G. Armitage. Training on multiple sub-flows to optimise the use of machine learning classifiers in real-world ip networks. In Local Computer Networks, Proceedings 2006 31st IEEE Conference on, pages 369--376. IEEE, 2006."},{"key":"e_1_3_2_1_28_1","unstructured":"Ntop.org. nDPI. http:\/\/www.ntop.org\/products\/deep-packet-inspection\/ndpi\/ 2015.  Ntop.org. nDPI. http:\/\/www.ntop.org\/products\/deep-packet-inspection\/ndpi\/ 2015."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/1452520.1452539"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2046556.2046570"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00112-7"},{"key":"e_1_3_2_1_32_1","volume-title":"Kazakhstan upgrades censorship to deep packet inspection. https:\/\/blog.torproject.org\/blog\/kazakhstan-upgrades-censorship-deep-packet-inspection","year":"2012","unstructured":"Phobos. Kazakhstan upgrades censorship to deep packet inspection. https:\/\/blog.torproject.org\/blog\/kazakhstan-upgrades-censorship-deep-packet-inspection , 2012 . Phobos. Kazakhstan upgrades censorship to deep packet inspection. https:\/\/blog.torproject.org\/blog\/kazakhstan-upgrades-censorship-deep-packet-inspection, 2012."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2008.124"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/1151659.1159921"},{"key":"e_1_3_2_1_35_1","volume-title":"DTIC Document","author":"Rukhin A.","year":"2001","unstructured":"A. Rukhin , J. Soto , J. Nechvatal , M. Smid , and E. Barker . A statistical test suite for random and pseudorandom number generators for cryptographic applications. Technical report , DTIC Document , 2001 . A. Rukhin, J. Soto, J. Nechvatal, M. Smid, and E. Barker. A statistical test suite for random and pseudorandom number generators for cryptographic applications. Technical report, DTIC Document, 2001."},{"key":"e_1_3_2_1_36_1","volume-title":"Employing entropy in the detection and monitoring of network covert channels","author":"Sanders C.","year":"2012","unstructured":"C. Sanders , J. Valletta , B. Yuan , and D. Johnson . Employing entropy in the detection and monitoring of network covert channels . 2012 . C. Sanders, J. Valletta, B. Yuan, and D. Johnson. Employing entropy in the detection and monitoring of network covert channels. 2012."},{"key":"e_1_3_2_1_37_1","unstructured":"Seleniumhq.org. Selenium - web browser automation. http:\/\/www.seleniumhq.org\/ 2015.  Seleniumhq.org. Selenium - web browser automation. http:\/\/www.seleniumhq.org\/ 2015."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.14778\/1687553.1687609"},{"key":"e_1_3_2_1_39_1","volume-title":"https:\/\/gitweb.torproject.org\/pluggable-transports\/obfsproxy.git\/tree\/doc\/obfs2\/obfs2-protocol-spec.txt","year":"2015","unstructured":"Tor project. Obfsproxy2. https:\/\/gitweb.torproject.org\/pluggable-transports\/obfsproxy.git\/tree\/doc\/obfs2\/obfs2-protocol-spec.txt , 2015 . Tor project. Obfsproxy2. https:\/\/gitweb.torproject.org\/pluggable-transports\/obfsproxy.git\/tree\/doc\/obfs2\/obfs2-protocol-spec.txt, 2015."},{"key":"e_1_3_2_1_40_1","volume-title":"https:\/\/gitweb.torproject.org\/pluggable-transports\/obfsproxy.git\/tree\/doc\/obfs3\/obfs3-protocol-spec.txt","year":"2015","unstructured":"Tor project. Obfsproxy3. https:\/\/gitweb.torproject.org\/pluggable-transports\/obfsproxy.git\/tree\/doc\/obfs3\/obfs3-protocol-spec.txt , 2015 . Tor project. Obfsproxy3. https:\/\/gitweb.torproject.org\/pluggable-transports\/obfsproxy.git\/tree\/doc\/obfs3\/obfs3-protocol-spec.txt, 2015."},{"key":"e_1_3_2_1_41_1","volume-title":"https:\/\/stem.torproject.org\/","year":"2015","unstructured":"Tor project. Stem. https:\/\/stem.torproject.org\/ , 2015 . Tor project. Stem. https:\/\/stem.torproject.org\/, 2015."},{"key":"e_1_3_2_1_42_1","volume-title":"Tor meek. https:\/\/trac.torproject.org\/projects\/tor\/wiki\/doc\/meek","year":"2015","unstructured":"Tor project. Tor meek. https:\/\/trac.torproject.org\/projects\/tor\/wiki\/doc\/meek , 2015 . Tor project. Tor meek. https:\/\/trac.torproject.org\/projects\/tor\/wiki\/doc\/meek, 2015."},{"key":"e_1_3_2_1_43_1","volume-title":"Tor metrics. https:\/\/metrics.torproject.org\/","year":"2015","unstructured":"Tor project. Tor metrics. https:\/\/metrics.torproject.org\/ , 2015 . Tor project. Tor metrics. https:\/\/metrics.torproject.org\/, 2015."},{"key":"e_1_3_2_1_44_1","volume-title":"uProxy. https:\/\/www.uproxy.org\/","author":"University of Washington.","year":"2015","unstructured":"University of Washington. uProxy. https:\/\/www.uproxy.org\/ , 2015 . University of Washington. uProxy. https:\/\/www.uproxy.org\/, 2015."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382212"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382211"},{"key":"e_1_3_2_1_47_1","volume-title":"NDSS","author":"White A. M.","year":"2013","unstructured":"A. M. White , S. Krishnan , M. Bailey , F. Monrose , and P. A. Porras . Clear and present data: Opaque traffic and its security implications for the future . In NDSS , 2013 . A. M. White, S. Krishnan, M. Bailey, F. Monrose, and P. A. Porras. Clear and present data: Opaque traffic and its security implications for the future. In NDSS, 2013."},{"key":"e_1_3_2_1_48_1","unstructured":"B. Wiley. Dust: A blocking-resistant internet transport protocol. Technical rep ort. http:\/\/blanu. net\/Dust. pdf 2011.  B. Wiley. Dust: A blocking-resistant internet transport protocol. Technical rep ort. http:\/\/blanu. net\/Dust. pdf 2011."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/1163593.1163596"},{"key":"e_1_3_2_1_50_1","volume-title":"The great firewall of China: How it blocks tor and why it is hard to pinpoint","author":"Winter P.","year":"2012","unstructured":"P. Winter and J. R. Crandall . The great firewall of China: How it blocks tor and why it is hard to pinpoint . 2012 . P. Winter and J. R. Crandall. The great firewall of China: How it blocks tor and why it is hard to pinpoint. 2012."},{"key":"e_1_3_2_1_51_1","volume-title":"Free and Open Communications on the Internet","author":"Winter P.","year":"2012","unstructured":"P. Winter and S. Lindskog . How the great firewall of China is blocking tor . Free and Open Communications on the Internet , 2012 . P. Winter and S. Lindskog. How the great firewall of China is blocking tor. Free and Open Communications on the Internet, 2012."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/2517840.2517856"},{"key":"e_1_3_2_1_53_1","first-page":"133","volume-title":"Internet censorship in China: Where does the filtering occur? In Passive and Active Measurement","author":"Xu X.","year":"2011","unstructured":"X. Xu , Z. M. Mao , and J. A. Halderman . Internet censorship in China: Where does the filtering occur? In Passive and Active Measurement , pages 133 -- 142 . Springer , 2011 . X. Xu, Z. M. Mao, and J. A. Halderman. Internet censorship in China: Where does the filtering occur? In Passive and Active Measurement, pages 133--142. Springer, 2011."},{"key":"e_1_3_2_1_54_1","volume-title":"https:\/\/github.com\/Yawning\/obfs4\/blob\/master\/doc\/obfs4-spec.txt","year":"2015","unstructured":"Yawning. Obfsproxy4. https:\/\/github.com\/Yawning\/obfs4\/blob\/master\/doc\/obfs4-spec.txt , 2015 . Yawning. Obfsproxy4. https:\/\/github.com\/Yawning\/obfs4\/blob\/master\/doc\/obfs4-spec.txt, 2015."},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2008.307"}],"event":{"name":"CCS'15: The 22nd ACM Conference on Computer and Communications Security","location":"Denver Colorado USA","acronym":"CCS'15","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2810103.2813715","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2810103.2813715","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T05:48:25Z","timestamp":1750225705000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2810103.2813715"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,10,12]]},"references-count":55,"alternative-id":["10.1145\/2810103.2813715","10.1145\/2810103"],"URL":"https:\/\/doi.org\/10.1145\/2810103.2813715","relation":{},"subject":[],"published":{"date-parts":[[2015,10,12]]},"assertion":[{"value":"2015-10-12","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}