Feature Request
Implement statistical traffic mimicry to make proxy traffic indistinguishable from real HTTPS at the packet level.
Problem
While our fake-TLS handshake looks correct, the data transfer phase has different statistical properties than real HTTPS:
- Record sizes are uniform (all same size)
- Inter-packet timing is determined by MTProto protocol, not HTTP response patterns
- A statistical classifier analyzing packet size/timing distributions can distinguish proxy traffic from real HTTPS
Prior Art: mtg's Doppelganger
mtg implements the most sophisticated approach (mtglib/internal/doppel/):
Dynamic Record Sizing (DRS)
Mimics how real web servers progressively enlarge TLS records:
- First ~40 records: MTU-sized (< 1500 bytes)
- Next records: ramp to 4096 bytes
- Final records: 16384 bytes (maximum TLS record payload)
This matches TCP slow-start behavior — real servers optimize for initial latency, then throughput.
Weibull-distributed Inter-packet Delays
Instead of uniform or no delays, models real HTTPS response timing:
- Shape parameter (k) estimated via Maximum Likelihood Estimation (70-iteration bisection)
- Scale parameter (λ) derived from observed samples
- Delay generation:
X = λ·(-ln U)^(1/k) where U ~ Uniform[0,1]
The Weibull distribution captures the "burst then tail" pattern of real content delivery.
Statistics Collection
Periodically fetches configured URLs over HTTPS and measures:
- Response sizes per TLS record
- Inter-record timing
- Uses these real-world samples to parameterize the distributions
Implementation Complexity
This is a high-effort feature. In our C codebase it would require:
- Weibull distribution fitting (MLE with bisection)
- Record size scheduling during relay
- Timer-based delay injection in the event loop
- Periodic HTTPS sampling of reference URLs
- Configuration for reference URLs and sampling interval
Priority
Long-term. The transparent masking (#45) provides more anti-detection value with less effort. This is for environments where statistical traffic analysis is actively deployed.
Feature Request
Implement statistical traffic mimicry to make proxy traffic indistinguishable from real HTTPS at the packet level.
Problem
While our fake-TLS handshake looks correct, the data transfer phase has different statistical properties than real HTTPS:
Prior Art: mtg's Doppelganger
mtg implements the most sophisticated approach (
mtglib/internal/doppel/):Dynamic Record Sizing (DRS)
Mimics how real web servers progressively enlarge TLS records:
This matches TCP slow-start behavior — real servers optimize for initial latency, then throughput.
Weibull-distributed Inter-packet Delays
Instead of uniform or no delays, models real HTTPS response timing:
X = λ·(-ln U)^(1/k)where U ~ Uniform[0,1]The Weibull distribution captures the "burst then tail" pattern of real content delivery.
Statistics Collection
Periodically fetches configured URLs over HTTPS and measures:
Implementation Complexity
This is a high-effort feature. In our C codebase it would require:
Priority
Long-term. The transparent masking (#45) provides more anti-detection value with less effort. This is for environments where statistical traffic analysis is actively deployed.