Modeling and Detecting Internet Censorship Events

Modeling and Detecting Internet Censorship Events

Speakers: Elisa Tsai

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=uGBxcb2w1ZE

Overview

In an era where internet freedom is increasingly challenged, understanding and detecting censorship events is paramount for human rights organizations, journalists, and researchers. However, the sheer volume and complexity of global censorship measurement data, such as the tens of billions of measurements collected by observatories like OONI and Censored Planet, present an overwhelming challenge for analysis. Traditional manual approaches are unscalable, while previous time-series methods often lack the interpretability needed for non-experts to grasp the nuances of diverse blocking policies. Elisa Tsai's presentation at NDSS Symposium introduces CenDTect, a novel, unsupervised learning system designed to bridge this critical gap.

CenDTect stands out by offering an automatic tool that provides interpretable results at both country and local network levels, enriching the context available to users of censorship observatories. Built on decision trees and featuring an innovative clustering approach with a custom cross-classification accuracy distance metric, CenDTect efficiently processes massive datasets. Its extensive analysis of over 70 billion data points from Censored Planet, spanning January 2019 to December 2022, has yielded remarkable insights, including the discovery of 15,360 HTTP(S) event clusters across 192 countries and 1,166 DNS event clusters in 77 countries. The system's ability to characterize confirmed censorship events and uncover previously unreported ones underscores its potential to significantly enhance global internet freedom monitoring.

Background

▶ Watch: Introducing CenDTect and censorship data challenges (0:00)

Internet censorship manifests through various intricate mechanisms across multiple network protocols. At the DNS level, queries can be dropped, manipulated to return non-zero Rcode errors, or redirected to private IP addresses or blockpage IPs. Even if DNS resolution succeeds, HTTPS requests remain vulnerable to interception, leading to packet drops, connection resets, or injected responses based on TLS headers or HTTP content. Numerous studies have investigated internet censorship, ranging from focused country-specific reports to broad global measurement initiatives. These global measurements typically fall into two categories: in situ measurements, conducted by client devices located within the censored country (e.g., OONI, IClab), and remote measurements, which utilize public-facing systems outside the country to detect disruptions (e.g., Censored Planet).

Prior approaches to censorship event detection have faced significant limitations. Many treated collected measurements as stationary data, simply identifying countries with high censorship levels based on the percentage of anomalous measurements. Others adopted time-series analysis, often relying on heavily manual methods or statistical techniques like bitmap-based moving windows. While these time-series analyses offered a starting point, they frequently fell short in critical areas. They typically provided only a binary judgment on whether a country was censoring, failing to differentiate between ISP-level and organizational blocking, thereby overlooking the inherent heterogeneity of blocking policies within a single country. For instance, bitmap-based detection proved susceptible to false negatives in regions with persistently high blocking rates, such as Venezuela, where a low anomaly threshold would trigger an overwhelming number of false positives. Manual analysis, though accurate, like OONI's volunteer-driven reports, suffered from severe scalability issues, leading to many emerging events being inevitably overlooked. While some recent work, such as Brown et al. 11, explored supervised learning for DNS manipulation, their objective was distinct from CenDTect's, which aims to model and detect censorship events rather than individual DNS measurement anomalies. Adopting supervised learning for event modeling would necessitate a comprehensive global ground truth, which is exceedingly challenging to acquire.

To provide clarity, the talk defined several key terms:

• Internet Censorship: The act of blocking access to domains through methods like DNS manipulation or HTTP(S) request filtering.
• Censorship Event: The implementation of new blocking measures by a controlling authority, which could be a government, an Internet Service Provider (ISP), or an organization.
• Simultaneous Blocking: A phenomenon where a group of domains experiences similar blocking policies within specific censored regions.
• IP Organizations: The entity listed in the WHOIS record for an IP address, which typically owns or manages the underlying network infrastructure.

Key Findings

▶ Watch: CenDTect's extensive findings and validation results (2:00)

CenDTect's extensive analysis has yielded significant insights into the landscape of global internet censorship, demonstrating its capability to identify both known and previously unreported events with high fidelity and interpretability. The system processed 70 billion data points from Censored Planet, refining 6 terabytes of raw data into a manageable 238 megabytes of interpretable event clusters.

A primary validation of CenDTect involved evaluating its output against a Potential Censorship Event List (PCEL), a manually curated list of 38 events from 2019-2020 derived from sources like OONI reports, Google Transparency Report, Access Now, and news media. After careful manual analysis, 12 of these events exhibited clear blocking signals within Censored Planet's raw data. CenDTect successfully provided informative characterizations for all 12 of these confirmed PCEL events. In stark contrast, a bitmap anomaly detection technique, a common prior method, detected anomalies in only 7 of these 12 cases. The bitmap method particularly struggled in countries with persistently high blocking rates, like Venezuela, where its lack of interpretability provided no information on geolocation, blocking method, or specific blocked domains.

CenDTect's non-detection of the remaining 26 PCEL events was primarily attributed to inherent limitations in Censored Planet's data collection, falling into three categories: No Measurements (46.15%), where Censored Planet lacked vantage points or the events were too short-lived; No Blocking (11.5%), where all measurements showed accessible domains; and No New Events (42.31%), indicating persistent blocking was present but no new or temporary events corresponding to the reported incidents were found. This demonstrates CenDTect's crucial ability to distinguish between ongoing, persistent blocking and new, temporary censorship events.

Beyond validation, CenDTect proved its prowess in discovering unreported events. Focusing on unique temporary events identified in Censored Planet's 12-month HTTP(S) measurements in 2022, the system uncovered 11 unique ISP temporary HTTP(S) events. These events featured blocklists distinct from the top five categories of domains persistently blocked in the same regions. These temporary blocking incidents frequently targeted news media, social networks, and anonymization tools, often coinciding with periods of heightened political sensitivity such as elections, political unrest, protests, and war. For instance, during the September 2022 protests in Iran, CenDTect detected the blocking of multiple anonymization tools. Notably, 7 of these 11 events (63.64%) were subsequently confirmed by news media or OONI data, while the remaining 4 unconfirmed events highlight CenDTect's unique capability to detect incidents not yet known to the broader community, emphasizing the value of data-driven perspectives in censorship monitoring.

In total, CenDTect discovered an impressive 15,360 HTTP(S) clusters across 192 countries and 1,166 DNS clusters in 77 countries. Key characteristics of global censorship revealed by CenDTect include:

• Prevalence of Organizational Blocking: The system identified widespread organizational blocking, even in countries typically considered free, such as the United States (where 59 clusters were related to organizational blocking), Australia, Canada, and Japan.
• Heterogeneity of Blocking within Countries: CenDTect's granular analysis revealed that censorship behavior is highly heterogeneous. While countries like China, Kazakhstan, Oman, and Venezuela exhibit consistent ISP-level persistent blocking, others such as Egypt, Russia, and India display diverse blocking behaviors even within ISP-level censorship. This finding underscores the unreliability of relying solely on aggregate country-level blocking ratios.
• Persistent ISP Blocking: CenDTect provided the first global report on persistent ISP blocking across 32 countries, including 21 classified as "Not Free," 9 as "Partly Free," and 2 as "Free" by Freedom House. These findings were further corroborated using OONI data, identifying Autonomous Systems (ASes) with anomalous measurements in the same categories.
• Interpretable Outputs: A core contribution is CenDTect's generation of clear, human-interpretable decision trees, which depict detailed blocking rules. These outputs specify the geolocation (country, AS, IP organization), the timespan of the event, the exact blocking method (e.g., DNS poisoning, TCP reset, blockpage injection), and the specific domains affected.
• Automation and Scalability: By automating the analysis of massive datasets, CenDTect overcomes the scalability issues inherent in manual analysis, enabling the efficient discovery of both known and previously unreported censorship events on a global scale.

Technical Deep Dive

▶ Watch: Key definitions: censorship, event, simultaneous blocking (4:07)

CenDTect's architecture and methodology are predicated on two fundamental observation-based assumptions regarding internet censorship. First, it assumes that IP organizations represent the most appropriate atomic unit of censorship, given that network administrators within these organizations are typically responsible for implementing and updating blocking policies. Second, censorship events are generally characterized by the simultaneous blocking of multiple domains, whether due to the introduction of new blocking techniques or updates to existing blocklists. This assumption is supported by curated lists of censorship events derived from news and reports.

The primary objective of CenDTect is to identify censorship events by answering four critical questions:

1. Where: The precise geolocation of the vantage points involved (country, Autonomous System, IP organization).
2. When: The specific timespan during which the censorship event occurred.
3. How: The blocking method employed (e.g., DNS poisoning, TCP reset, blockpage injection).
4. What: The set of domains included in the blocklist.

Items (1)-(3) collectively define the blocking rule ($R_e$) of a censorship event. A complete censorship event ($C_e$) is then defined as a specific blocking rule $R_e$ coupled with the set of domains ($d_o1, d_o2, ..., d_on$) whose measurement signals can be described by that rule. To effectively extract these blocking rules and their corresponding domains, CenDTect must discover sets of vantage points that exhibit identical blocking behavior for a given set of domains. For a domain $d_i$, its data within a country $c$ over a timespan $t_1$ to $t_m$ is initially represented as a matrix $RES_d_i,c,t_1,t_m$. Each entry $res_i(j,k)$ in this matrix signifies the parsed class label of vantage point $vp_j$ at time $t_k$. This raw data is then aggregated by IP organizations, leveraging the core assumption that these organizations are the atomic units of censorship. This transformation yields a weighted distribution of response classes for a domain within an IP organization over time.

To identify homogeneous blocking patterns, CenDTect employs decision trees. These are well-suited for the task because they recursively partition data based on the most informative features, which aligns perfectly with the goal of pinpointing regions and timespans characterized by consistent blocking policies. A separate decision tree ($DT_i$) is generated for each domain $d_i$ to capture its unique blocking behavior, a design choice that significantly preserves interpretability. Even when processing a year's worth of data, the generated decision trees maintain an average depth of less than 16, with a maximum depth not exceeding 25, ensuring they remain manageable and comprehensible.

A crucial innovation introduced by CenDTect is its novel distance metric for comparing tree structures, termed cross-classification accuracy. This metric is used to measure the proximity between two domains, say $d_i$ and $d_j$, and is defined as $DTDIST(d_i, d_j) = 1 - max(DT_i.Pred(RES_d_j), DT_j.Pred(RES_d_i))$. Essentially, this metric evaluates how accurately the decision tree of one domain can classify the measurement data of another domain. A higher cross-classification accuracy implies similar blocking behavior between the two domains. CenDTect assigns class label 0 for normal accessibility and positive integers for various types of network anomalies, such as TCP resets or blockpages, indicating different forms of censorship. The system first efficiently filters out "innocent trees" (domains showing no censorship), which is effective given the inherent rarity of global censorship events.

CenDTect's architecture is structured into three main stages:

1. Censored Planet Raw Data Preprocessing: This initial stage ingests raw global censorship measurement data from Censored Planet. It preprocesses this data, augmenting it with crucial metadata such as IP ownership details and domain categories. The data flows through a BigQuery pipeline, where it undergoes aggregation, flattening, and feature selection to prepare it for subsequent analysis.
2. Data Mining: This is the core computational stage of CenDTect. It iteratively generates decision trees for each domain and then clusters these domains based on the similarity of their blocking rules, utilizing the DTDIST metric. The identified clusters are then semantically parsed to extract the specific blocking rules that define each censorship event.
3. Application: The resulting event clusters are then available for various applications. These include prominent event discovery, powering a search engine for specific censorship queries, and generating real-time alerts for emerging censorship events.

The clustering process is central to CenDTect's functionality. Algorithm 1, getDomainTreeClusters, outlines an iterative clustering approach. It begins by identifying and removing domains that show no signs of censorship ("innocent domains"). It then enters a loop that repeatedly calls genInitialClusters to discover new clusters, merges them if necessary, and parses the associated events. The loop terminates when no new events are found, an iterative strategy vital for handling overlapping events and ensuring comprehensive detection of all censorship events linked to a domain. Algorithm 2, genInitialClusters, performs the actual clustering. It generates decision trees in parallel for each domain, then groups domains with unique trees. These unique trees are subsequently fed into a DBSCAN clustering algorithm. DBSCAN is chosen for its density-based nature, which allows it to discover clusters of arbitrary shapes, a characteristic well-suited to the complex and varied patterns of censorship data. The DTDIST metric serves as the distance measure within the DBSCAN algorithm.

CenDTect is implemented in Python 3.10 and runs on a Linux server equipped with 32 GB of RAM and a 12-core processor. The model includes several tunable hyperparameters, notably the date range for analysis and the epsilon parameter for DBSCAN. The epsilon threshold is set conservatively at 99.5%, accounting for the rarity of censorship events (prior research indicates global blocking rates of only 1-2%) and providing tolerance for occasional temporal glitches. This threshold can be adjusted by future users based on their specific investigative needs. For countries with a large number of ASes, data can be efficiently split by AS during preprocessing. CenDTect parses Censored Planet's raw HTTP(S) and DNS responses into a comprehensive taxonomy of 4,370 distinct classes, categorized into Benign, Very Unlikely Censorship, Unlikely Censorship, and Likely Censorship. For the purpose of the paper, the focus was conservatively placed on clusters of the "Likely Censorship" type, which signifies clear and unambiguous blocking signals such as blockpages or TCP resets, ensuring accurate representation of censorship events.

Ethical considerations are paramount in this field. CenDTect's analysis relies exclusively on historical data from Censored Planet, which adheres to established ethical norms and best practices designed to minimize risk to users and researchers. The project acknowledges the ethical implications of utilizing such sensitive data and handles it with extreme caution, guided by extensive community discussions and workshops on censorship measurement ethics.

Demo / Proof of Concept

▶ Watch: Core assumptions and four key questions for event detection (6:00)

While the talk did not feature a live, interactive demo, CenDTect's core functionality and interpretability were effectively demonstrated through a conceptual example and the presentation of its real-world discovery capabilities. Figure 5 from the paper, referenced in the talk, provides a clear "toy example" illustrating how CenDTect's cross-classification accuracy metric and iterative clustering process can disentangle complex, overlapping blocking rules.

Consider a scenario with three domains: google.com, twitter.com, and facebook.com, within a country serviced by three Autonomous Systems (ASes). Imagine these domains exhibiting the following blocking patterns:

• google.com: Blocked in AS1 via TCP reset after June 1.
• twitter.com: Blocked in AS1 and AS3 via TCP reset after June 1.
• facebook.com: Blocked in AS3 via TCP reset after June 1.

Each domain generates a distinct decision tree representing its specific blocking rule. CenDTect, leveraging its DTDIST metric, can precisely measure the similarity between these trees. Its iterative clustering algorithm then efficiently separates these patterns, identifying distinct clusters even where blocking rules overlap. For instance, it would correctly group twitter.com and facebook.com based on their shared blocking in AS3, while also recognizing google.com and twitter.com for their shared blocking in AS1, and ultimately isolating the unique aspects of each event. This conceptual demonstration highlights CenDTect's ability to provide granular, interpretable insights into heterogeneous censorship policies.

Furthermore, a compelling proof of concept for CenDTect's real-world utility is its discovery of 11 unique ISP temporary HTTP(S) events in 2022 that were previously unreported. These events, identified from 2,590 HTTP(S) and 1,166 DNS clusters, showed distinct blocklists and timespans, often coinciding with critical political periods such as elections, protests, and war. For example, CenDTect detected the blocking of multiple anonymization tools during the September 2022 protests in Iran. The fact that 7 of these 11 events (63.64%) were later confirmed by news media or OONI data, with the remaining 4 representing unconfirmed discoveries, serves as a powerful testament to CenDTect's capability to proactively detect emerging censorship events that might otherwise go unnoticed by the broader community. This demonstrates the system's practical value in providing early warnings and deeper contextual understanding of internet freedom infringements.

Defensive Implications

▶ Watch: Using decision trees and cross-classification accuracy (8:00)

CenDTect offers a robust framework for various stakeholders involved in defending internet freedom, providing actionable intelligence and tools for monitoring and responding to censorship.

For researchers, journalists, and non-governmental organizations (NGOs) focused on human rights and internet freedom, CenDTect provides an unprecedented level of detail and interpretability. Instead of aggregate, often misleading, country-level censorship statistics, they can access specific decision trees that clearly delineate where (geolocation, AS, IP organization), when (timespan), how (blocking method like TCP resets or blockpages), and what (specific domains on the blocklist) censorship is occurring. This granular information is invaluable for:

• Targeted Advocacy: Identifying specific IP organizations or ASes responsible for blocking enables more precise advocacy efforts, rather than broad accusations against an entire country.
• Informed Reporting: Journalists can use CenDTect's output to provide more detailed and evidence-based reports on censorship incidents, including the exact techniques used and the domains affected.
• Resource Allocation: NGOs can better allocate resources by understanding the specific types of blocking (e.g., persistent ISP blocking vs. temporary event-driven blocking) and the regions most affected. The system’s identification of over 100 ASes in 32 countries with persistent ISP blocking offers a clear target for sustained monitoring and counter-censorship efforts.

Internet users and developers of circumvention tools can also benefit. Understanding the specific blocking methods (e.g., DNS poisoning vs. HTTP content filtering) and the IP organizations implementing them allows for the development and deployment of more effective and targeted circumvention strategies. CenDTect's ability to detect temporary blocking events during periods of political unrest or elections provides early warnings, enabling users in affected regions to proactively deploy anti-censorship tools.

The alerting system functionality of CenDTect is a critical defensive tool. By automatically fetching recent scans and flagging new events where a domain's category falls outside the top K persistently blocked categories in a country (with K=5 in the presented work), it provides real-time detection of emerging censorship. This capability is crucial for rapid response, allowing defenders to quickly identify and publicize new blocking measures, potentially increasing the cost for censors and mobilizing international pressure.

Furthermore, CenDTect highlights the heterogeneity of blocking within countries, demonstrating that relying solely on country-level blocking ratios can be error-prone. Defenders must adopt a more nuanced perspective, understanding that even within a single nation, different ISPs or organizations may implement vastly different blocking policies. This necessitates a localized and adaptive defensive posture.

Finally, the talk emphasizes the importance of collaboration with in-country experts, activists, journalists, and researchers. While automated systems like CenDTect can process vast amounts of data, the qualitative insights and ground truth provided by those on the front lines are indispensable for fully contextualizing and leveraging the data for effective defense. This synergy between automated detection and human intelligence is key to robust internet freedom monitoring.

Key Takeaways

• Automated and Interpretable Censorship Detection: CenDTect is a novel, unsupervised learning system that automates the discovery of internet censorship events, providing highly interpretable results through decision trees that detail geolocation, timespan, blocking method, and affected domains.
• Scalability for Massive Datasets: The system efficiently processes tens of billions of measurements, refining 6 terabytes of raw data into a manageable 238 megabytes of event clusters, effectively addressing the scalability challenges of manual analysis.
• Discovery of Unreported Events: CenDTect successfully identified 11 unique temporary HTTP(S) blocking events in 2022, with 4 of these being previously unconfirmed, demonstrating its capability to uncover emerging censorship incidents not yet known to the broader community.
• Granular Insights into Censorship Landscape: The analysis revealed widespread organizational blocking (e.g., 59 clusters in the US) and provided the first global report on persistent ISP blocking across 32 countries, highlighting the significant heterogeneity of blocking policies within nations.
• Innovative Technical Approach: CenDTect employs a unique methodology centered on IP organizations as the unit of censorship, generates domain-specific decision trees, and introduces a novel cross-classification accuracy metric for iterative clustering using DBSCAN.
• Actionable Intelligence for Defenders: The system's detailed, interpretable outputs and real-time alerting capabilities provide crucial information for researchers, journalists, NGOs, and circumvention tool developers to understand, report on, and respond to internet censorship effectively.

About the Speaker(s)

Elisa Tsai is the presenter of CenDTect, a novel system for modeling and detecting internet censorship events. Based on the detailed technical content and the introduction of CenDTect as "our novel system," it can be inferred that Elisa Tsai is a leading researcher and key developer behind this significant work in the field of internet freedom and censorship measurement. Her presentation at the NDSS Symposium highlights her expertise in applying machine learning techniques to complex cybersecurity and human rights challenges, specifically focusing on making vast censorship datasets more accessible and interpretable for a wide range of users.