🧬 Protocol mutation engine — make every connection unique to defeat DPI fingerprinting

[sepehrsadri]

Why This is a Game-Changer

Iran's DPI fingerprints protocols by their static patterns. A protocol mutation engine would make every connection look unique, making signature-based blocking nearly impossible.

Concept

Connection 1: TLS ClientHello with Chrome fingerprint → VLESS over h2
Connection 2: TLS ClientHello with Firefox fingerprint → VLESS over WebSocket  
Connection 3: TLS ClientHello with Safari fingerprint → VLESS over XHTTP
Connection 4: QUIC Initial → Hysteria2 with randomized padding

Each connection uses different:

• TLS fingerprint (ja3/ja4)
• ALPN negotiation
• Packet sizes and timing
• Transport layer (h2, ws, xhttp, quic)
• SNI (rotated from a pool of allowed domains)

Research Tasks

• Survey existing protocol obfuscation tools (obfs4, Shadowsocks plugins, Cloak, Shadow)
• Research Geneva project — automated discovery of censorship evasion strategies using genetic algorithms
• Build a TLS fingerprint rotation library (randomize ja3 per connection)
• Test which fingerprint dimensions Iran's DPI actually checks (SNI? ja3? packet size? timing?)
• Prototype: sing-box plugin that mutates transport per connection
• Measure detection rates before/after mutation from a censored network

Key References

• Geneva Project — AI-powered censorship evasion
• uTLS — TLS fingerprint mimicry in Go
• Restler — Traffic replay with mutations
• GFW Report — Technical analysis of China's firewall (similar tech to Iran)
• RESEARCH-TOPICS.md — Topic 3a: Protocol Mutation / Polymorphism

Impact

If successful, this makes all our existing protocols harder to detect, not just new ones. It's a force multiplier.