{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T04:02:07Z","timestamp":1791950527981,"version":"4.3.4"},"reference-count":23,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2024,12,20]],"date-time":"2024-12-20T00:00:00Z","timestamp":1734652800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1518888, 1823192, 2007741, 2042795, 2120400"],"award-info":[{"award-number":["1518888, 1823192, 2007741, 2042795, 2120400"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Commun. ACM"],"published-print":{"date-parts":[[2025,1]]},"abstract":"<jats:p>VPN adoption has seen steady growth over the past decade due to increased public awareness of privacy and surveillance threats. In response, certain governments are attempting to restrict VPN access by identifying connections using \u201cdual use\u201d DPI technology. To investigate the potential for VPN blocking, we develop mechanisms for accurately fingerprinting connections using OpenVPN, the most popular protocol for commercial VPN services. We identify three fingerprints based on protocol features such as byte pattern, packet size, and server response. Playing the role of an attacker who controls the network, we design a two-phase framework that performs passive fingerprinting and active probing in sequence. We evaluate our framework in partnership with a million-user ISP and find that we identify over 85% of OpenVPN flows with only negligible false positives, suggesting that OpenVPN-based services can be effectively blocked with little collateral damage. Although some commercial VPNs implement countermeasures to avoid detection, our framework successfully identified connections to 34 out of 41 \u201cobfuscated\u201d VPN configurations. We discuss the implications of the VPN fingerprintability for different threat models and propose short-term defenses. In the longer term, we urge commercial VPN providers to be more transparent about their obfuscation approaches and to adopt more principled detection countermeasures, such as those developed in censorship circumvention research.<\/jats:p>","DOI":"10.1145\/3618117","type":"journal-article","created":{"date-parts":[[2024,6,6]],"date-time":"2024-06-06T15:51:22Z","timestamp":1717689082000},"page":"79-87","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":19,"title":["OpenVPN is Open to VPN Fingerprinting"],"prefix":"10.1145","volume":"68","author":[{"given":"Diwen","family":"Xue","sequence":"first","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Reethika","family":"Ramesh","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Arham","family":"Jain","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michaelis","family":"Kallitsis","sequence":"additional","affiliation":[{"name":"Merit Networks, Inc., Ann Arbor, MI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"J. Alex","family":"Halderman","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jedidiah R.","family":"Crandall","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Roya","family":"Ensafi","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,20]]},"reference":[{"key":"e_1_3_1_2_2","unstructured":"Openvpn xor patch; https:\/\/github.com\/clayface\/openvpnxorpatch."},{"key":"e_1_3_1_3_2","doi-asserted-by":"crossref","unstructured":"Alice B. Carol J.B. and Houmansadr A. How china detects and blocks shadowsocks. In ACM\u00a0Internet\u00a0Measurement\u00a0Conf.\u00a0(IMC) 2020.","DOI":"10.1145\/3419394.3423644"},{"key":"e_1_3_1_4_2","doi-asserted-by":"crossref","unstructured":"Bagui S. et al. Comparison of machine-learning algorithms for classification of vpn network traffic flow using time-related features. In J.\u00a0Of\u00a0Cyber\u00a0Security\u00a0Technology 2017.","DOI":"10.1080\/23742917.2017.1321891"},{"key":"e_1_3_1_5_2","doi-asserted-by":"crossref","unstructured":"Ensafi R. et al. Examining how the great firewall discovers hidden circumvention servers. In Proceedings\u00a0of\u00a0the\u00a02015\u00a0Internet\u00a0Measurement\u00a0Conf.","DOI":"10.1145\/2815675.2815690"},{"key":"e_1_3_1_6_2","doi-asserted-by":"crossref","unstructured":"Frolov S. Wampler J. and Wustrow E. Detecting probe-resistant proxies. In Network\u00a0and\u00a0Distributed\u00a0System\u00a0Security 2020.","DOI":"10.14722\/ndss.2020.23087"},{"key":"e_1_3_1_7_2","unstructured":"Fu P. et al. A netflow sequence attention network for virtual private network traffic detection. In Intern.\u00a0Conf.\u00a0On\u00a0Web\u00a0Information\u00a0Systems\u00a0Engineering."},{"key":"e_1_3_1_8_2","unstructured":"Gil G. Lashkari A. Mamun M. and Ghorbani A. Characterization of encrypted and VPN traffic using time-related features. In the 2nd Intern. Conf. on Information Systems Security and Privacy(ICISSP) 2016."},{"key":"e_1_3_1_9_2","unstructured":"Hoogstraaten H. Evaluating\u00a0Server-Side\u00a0Internet\u00a0Proxy\u00a0Detection\u00a0Methods\u00a0(Msc\u00a0Thesis) 2018."},{"key":"e_1_3_1_10_2","doi-asserted-by":"crossref","unstructured":"Houmansadr A. Brubaker C. and Shmatikov V. The parrot is dead: Observing unobservable network communications. In 2013\u00a0IEEE\u00a0S&P.","DOI":"10.1109\/SP.2013.14"},{"key":"e_1_3_1_11_2","unstructured":"Pluggable transports; https:\/\/pluggabletransports.info\/."},{"key":"e_1_3_1_12_2","doi-asserted-by":"crossref","unstructured":"Ramesh R. Evdokimov L. Xue D. and Ensafi R. Vpnalyzer: Systematic investigation of the VPN ecosystem. In Network\u00a0and\u00a0Distributed\u00a0System\u00a0Security 2022.","DOI":"10.14722\/ndss.2022.24285"},{"key":"e_1_3_1_13_2","doi-asserted-by":"crossref","unstructured":"Ramesh R. et al. Decentralized control: A case study of russia. In Network\u00a0and\u00a0Distributed\u00a0System\u00a0Security 2020.","DOI":"10.14722\/ndss.2020.23098"},{"key":"e_1_3_1_14_2","unstructured":"Attention\u00a0to\u00a0Companies\u00a0Using\u00a0Vpn\u00a0Services\u00a0in\u00a0Operation; https:\/\/rkn.gov.ru\/news\/rsoc\/news73628.htm."},{"key":"e_1_3_1_15_2","doi-asserted-by":"crossref","unstructured":"Sundara Raman R. et al. Measuring the deployment of network censorship filters at global scale. In Network\u00a0and\u00a0Distributed\u00a0System\u00a0Security 2020.","DOI":"10.14722\/ndss.2020.23099"},{"key":"e_1_3_1_16_2","unstructured":"Tolley W. et al. Blind in\/on-path attacks and applications to vpns. In 30th USENIX Security Symp. (USENIX Security 21)."},{"key":"e_1_3_1_17_2","doi-asserted-by":"crossref","unstructured":"Tschantz M. Anonymous S.A. and Paxson V. Sok: Towards grounding censorship circumvention in empiricism. In 2016\u00a0IEEE\u00a0Symp.\u00a0On\u00a0Security\u00a0and\u00a0Privacy\u00a0(SP).","DOI":"10.1109\/SP.2016.59"},{"key":"e_1_3_1_18_2","unstructured":"Indian\u00a0Parliamentary\u00a0Committee\u00a0Wants\u00a0to\u00a0Ban\u00a0VPN\u00a0Services\u00a0in\u00a0India; https:\/\/www.indiatimes.com\/technology\/news\/vpnban-indian-govt-vpn-services-in-india-548493.html."},{"key":"e_1_3_1_19_2","unstructured":"Chinese\u00a0Government\u00a0Orders\u00a0Isps\u00a0to\u00a0Block\u00a0Personal\u00a0VPN\u00a0Use; https:\/\/privateinternetaccess.com\/blog\/great-firewallchina-chinese-government-orders-isps-block-personalvpn-use-february-1st\/."},{"key":"e_1_3_1_20_2","unstructured":"China\u2019s\u00a0Firewall\u00a0Technology\u00a0Upgrades\u00a0Virtual\u00a0Private\u00a0Network\u00a0Management\u00a0and\u00a0Control\u00a0Tightening; https:\/\/www.rfa.org\/mandarin\/yataibaodao\/cyl-12212012155229.html."},{"key":"e_1_3_1_21_2","unstructured":"Rain\u00a0Throttles\u00a0Internet\u00a0Speeds\u00a0for\u00a0Customers\u00a0on\u00a0Vpns; https:\/\/mybroadband.co.za\/news\/internet\/384642-rain-throttles-internet-speeds-for-customers-onvpns.html."},{"key":"e_1_3_1_22_2","doi-asserted-by":"crossref","unstructured":"Wang L. et al. Seeing through network-protocol obfuscation. In Proceedings of the 22nd ACM SIGSAC Conf. on Computer and Communications Security 2015.","DOI":"10.1145\/2810103.2813715"},{"key":"e_1_3_1_23_2","volume-title":"2016\u00a0IEEE\u00a0Conf.\u00a0On\u00a0Communications\u00a0and\u00a0Network\u00a0Security\u00a0(CNS)","author":"Webb A.","unstructured":"Webb, A. and Reddy, A. Finding proxy users at the service using anomaly detection. In 2016\u00a0IEEE\u00a0Conf.\u00a0On\u00a0Communications\u00a0and\u00a0Network\u00a0Security\u00a0(CNS). IEEE."},{"key":"e_1_3_1_24_2","volume-title":"2nd USENIX Workshop on Free and Open Communications on the Internet (FOCI 12)","author":"Winter P.","unstructured":"Winter, P. and Lindskog, S. How the great firewall of china is blocking tor. In Proceedings of the\u00a02nd USENIX Workshop on Free and Open Communications on the Internet (FOCI 12). USENIX Assoc., Bellevue, WA, USA.\u00a0"}],"container-title":["Communications of the ACM"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3618117","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3618117","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3618117","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:37:58Z","timestamp":1750178278000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3618117"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,20]]},"references-count":23,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,1]]}},"alternative-id":["10.1145\/3618117"],"URL":"https:\/\/doi.org\/10.1145\/3618117","relation":{},"ISSN":["0001-0782","1557-7317"],"issn-type":[{"value":"0001-0782","type":"print"},{"value":"1557-7317","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,12,20]]},"assertion":[{"value":"2024-12-20","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}