Skip to content
This repository was archived by the owner on Apr 5, 2026. It is now read-only.

Anti-detection: statistical traffic mimicry (Doppelganger-style record sizing and timing) #50

Description

@dvershinin

Feature Request

Implement statistical traffic mimicry to make proxy traffic indistinguishable from real HTTPS at the packet level.

Problem

While our fake-TLS handshake looks correct, the data transfer phase has different statistical properties than real HTTPS:

  • Record sizes are uniform (all same size)
  • Inter-packet timing is determined by MTProto protocol, not HTTP response patterns
  • A statistical classifier analyzing packet size/timing distributions can distinguish proxy traffic from real HTTPS

Prior Art: mtg's Doppelganger

mtg implements the most sophisticated approach (mtglib/internal/doppel/):

Dynamic Record Sizing (DRS)

Mimics how real web servers progressively enlarge TLS records:

  • First ~40 records: MTU-sized (< 1500 bytes)
  • Next records: ramp to 4096 bytes
  • Final records: 16384 bytes (maximum TLS record payload)

This matches TCP slow-start behavior — real servers optimize for initial latency, then throughput.

Weibull-distributed Inter-packet Delays

Instead of uniform or no delays, models real HTTPS response timing:

  • Shape parameter (k) estimated via Maximum Likelihood Estimation (70-iteration bisection)
  • Scale parameter (λ) derived from observed samples
  • Delay generation: X = λ·(-ln U)^(1/k) where U ~ Uniform[0,1]

The Weibull distribution captures the "burst then tail" pattern of real content delivery.

Statistics Collection

Periodically fetches configured URLs over HTTPS and measures:

  • Response sizes per TLS record
  • Inter-record timing
  • Uses these real-world samples to parameterize the distributions

Implementation Complexity

This is a high-effort feature. In our C codebase it would require:

  1. Weibull distribution fitting (MLE with bisection)
  2. Record size scheduling during relay
  3. Timer-based delay injection in the event loop
  4. Periodic HTTPS sampling of reference URLs
  5. Configuration for reference URLs and sampling interval

Priority

Long-term. The transparent masking (#45) provides more anti-detection value with less effort. This is for environments where statistical traffic analysis is actively deployed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions