Does a traffic disguise actually make you harder to detect?
Encryption hides what you send, not the shape of your traffic. PRAXIS is a measurement process for checking whether a proxy configuration really lowers detection, and how far that result holds.
What the study found
Three settings a circumvention client controls, each tested in a controlled cloud lab against a passive observer that sees only traffic shape.
Browser camouflage
Changing the browser profile changed nothing a network detector sees. Traffic shape was the same with and without it.
Multiplexing
One setting cut the selection detector's confidence roughly in half. Independent detectors still flagged every session.
Resolution path
With DNS blocked, the selected transport kept working over an alternate hostname mapping.
How PRAXIS works
When you test many configurations and report the best one, the data that chose it cannot also be the evidence that it works. So selection and confirmation are kept apart.
Score many candidate configurations on lab sessions.
The lowest combined score advances.
Retest on 150 new sessions that played no part in selection.
Check against holdout detectors, calibrated thresholds, five detector families and five benign references.
The score (lower is better)
The weights are a default engineering policy, not optimized values. The observer uses packet counts and direction, payload bytes, burst count, the first 20 signed packet lengths and total session duration. It does not use inter-packet timing or handshake contents.
Results
Confirmation experiment: 50 sessions per configuration. Baseline has multiplexing off; the selected configuration uses multiplexing concurrency 2 with browser parallelism 1.
Detector confidence fell, but only for some detectors
Lower confidence did not mean escaping detection
| Detector | Mean probability | Threshold | Sessions flagged (of 50) |
|---|---|---|---|
| Selection detector | 0.487 | 0.5 | 3 (6%) |
| Holdout, strict-unseen | 0.666 | Calibrated to 0–5% false positives | 50 (100%) |
| Holdout, baseline-known | 0.663 | Calibrated to 0–5% false positives | 50 (100%) |
| Random forest | 0.580 | 0.5 | 49 (98%) |
| Extra trees | 0.839 | 0.5 | 50 (100%) |
| Gradient boosting | 1.000 | 0.5 | 50 (100%) |
| Linear SVC (calibrated) | 0.947 | 0.5 | 50 (100%) |
| Logistic regression | 0.996 | 0.5 | 50 (100%) |
The detector used to pick the winner was fooled most of the time. Independent detectors, set the way an operator would set them, caught everything. That gap is why the confirmation step exists.
What changed in the traffic
Multiplexed sessions were about 83% shorter, with about 22% fewer packets and 21% fewer bursts, carrying about the same payload. The traffic became a different shape; it did not become indistinguishable from the baseline.
Resolution path
| Resolver mode | Sessions succeeded | What it shows |
|---|---|---|
| Standard lab DNS | 30 of 30 | Reference |
| DNS blocked (port 53), no fallback | 0 of 30 | The block worked |
| Alternate hostname mapping | 30 of 30 | Compatibility, not censorship resistance |
Try it: score a configuration
Enter your own measurements, or load one of the study's configurations. Everything runs in your browser; nothing is uploaded.
All inputs are scaled 0 to 1. The compliance penalty applies only when success falls below 95%. A low score ranks a configuration; it does not show the configuration evades detection. Confirm with independent detectors.
Analyze a packet capture
Choose a .pcap or .pcapng file to extract the same traffic-shape features the study used, and compare them with the study's sessions. The file is read by your browser and never leaves your computer.
| Feature | Your capture | Study baseline (mux off) | Study selected (mux c2) |
|---|
First 20 signed packet lengths
Positive = sent by the client, negative = received. Lengths are transport payload bytes, as in the study.
Reproduce the statistics
Scripts, session-level data and statistical outputs are public. Re-running the confirmation statistics on the public data reproduces the archived numbers.
git clone https://github.com/zilantix/praxis.git cd praxis && pip install -r requirements.txt # set the input path in the script to: # artifacts/data_csv/phase17_confirm_session_scores.csv python artifacts/scripts/phase17_statistical_validation.py
Public
Analysis scripts, session CSVs for each phase, statistics tables and figures.
Restricted
Raw packet captures, trained detector files and lab logs, because of size, dataset license terms and credentials.
Benign references
MAWI backbone traces and CIC-IDS 2017. Obtain them from their original sources.
Limits and responsible use
- Training confound. Proxy sessions came from the lab and benign traffic from public captures, so detection rates may partly reflect the capture environment.
- Near-replicate sessions. Scripted workload and fixed destinations; statistical separation is not operational effect size.
- Static, shape-only observer. No inter-packet timing, no handshake content, no retraining against observed configurations.
- Narrow confirmation. Browser parallelism was held at 1.
- Narrow resolver test. One hostname and a local hosts-file mapping.