# Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning

arXiv: https://arxiv.org/abs/2302.02031 · HTML: https://mlsanity.com/paper/2302.02031/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 68 references that are in the map.
- First posted on arXiv 3 Feb 2023.

## Builds on (most cited first, 13 of 13)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Why do tree-based models still outperform deep learning on tabular data?](https://mlsanity.com/paper/2207.08815/) (2022)
- [Detecting and Characterizing Lateral Phishing at Scale](https://mlsanity.com/paper/1910.00790/) (2019)
- [How Great is the Great Firewall? Measuring China's DNS Censorship](https://mlsanity.com/paper/2106.02167/) (2021)
- [Feature Extraction for Novelty Detection in Network Traffic](https://mlsanity.com/paper/2006.16993/) (2020)
- [Domain Name Encryption Is Not Enough: Privacy Leakage via IP-based Website Fingerprinting](https://mlsanity.com/paper/2102.08332/) (2021)
- [The Anatomy of Web Censorship in Pakistan](https://mlsanity.com/paper/1307.1144/) (2013)
- [Where The Light Gets In: Analyzing Web Censorship Mechanisms in India](https://mlsanity.com/paper/1808.01708/) (2018)
- [ICLab: A Global, Longitudinal Internet Censorship Measurement Platform](https://mlsanity.com/paper/1907.04245/) (2019)
- [Measuring I2P Censorship at a Global Scale](https://mlsanity.com/paper/1907.07120/) (2019)
- [Assessing the Privacy Benefits of Domain Name Encryption](https://mlsanity.com/paper/1911.00563/) (2019)
- [The Web is Still Small After More Than a Decade](https://mlsanity.com/paper/2004.04623/) (2020)
- [Measuring the Accessibility of Domain Name Encryption and Its Impact on Internet Filtering](https://mlsanity.com/paper/2202.00663/) (2022)

## Built on by (most cited first, 1 of 1)

- [SwiftQueue: Optimizing Low-Latency Applications with Swift Packet Queuing](https://mlsanity.com/paper/2410.06112/) (2024)

## Abstract (arXiv)

The proliferation of global censorship has led to the development of a plethora of measurement platforms to monitor and expose it. Censorship of the domain name system (DNS) is a key mechanism used across different countries. It is currently detected by applying heuristics to samples of DNS queries and responses (probes) for specific destinations. These heuristics, however, are both platform-specific and have been found to be brittle when censors change their blocking behavior, necessitating a more reliable automated process for detecting censorship. In this paper, we explore how machine learning (ML) models can (1) help streamline the detection process, (2) improve the potential of using large-scale datasets for censorship detection, and (3) discover new censorship instances and blocking signatures missed by existing heuristic methods. Our study shows that supervised models, trained using expert-derived labels on instances of known anomalies and possible censorship, can learn the detection heuristics employed by different measurement platforms. More crucially, we find that unsupervised models, trained solely on uncensored instances, can identify new instances and variations of censorship missed by existing heuristics. Moreover, both methods demonstrate the capability to uncover a substantial number of new DNS blocking signatures, i.e., injected fake IP addresses overlooked by existing heuristics. These results are underpinned by an important methodological finding: comparing the outputs of models trained using the same probes but with labels arising from independent processes allows us to more reliably detect cases of censorship in the absence of ground-truth labels of censorship.