💻 computer science

Extended Abstract: Shaperd: Easily Adoptable Real-Time Traffic Shaper for Fully Encrypted Protocols

The paper proposes Shaperd, a real-time traffic shaper that uses a novel constraint system to modify packet contents and generate customizable traffic flows, thereby helping fully encrypted protocols evade censorship detection while introducing minimal throughput overhead.

Original authors: Sarah Wilson, Stella Tian, Sina Kamali

Published 2026-04-29

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Sarah Wilson, Stella Tian, Sina Kamali

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you live in a country where the government acts like a strict librarian who bans certain books. To get around this, people use "Fully Encrypted Protocols" (FEPs). Think of these as secret codes that turn your messages into a jumble of random, unreadable letters. To the librarian, it just looks like noise, so they can't tell what book you're trying to read.

However, the librarian has gotten smarter. They aren't just looking at what the message says; they are now looking at how the message is delivered. They've learned that even secret codes have a "fingerprint." For example, they might notice that a real secret message always has a specific number of letters, or that the letters arrive at perfectly regular intervals. Once they spot these patterns, they can block the message, even if they can't read it.

Enter Shaperd: The "Traffic Tailor"

The authors of this paper propose a new tool called Shaperd. You can think of Shaperd as a master tailor or a traffic director that sits between your secret code and the librarian. Its job is to take your raw, secret messages and "tailor" them so they look exactly like whatever the librarian expects to see, making them invisible to the censor's rules.

Here is how Shaperd works, using simple analogies:

1. The "Constraint" Menu (The Recipe)

Shaperd uses a special system called a constraint system. Imagine this as a recipe card or a set of rules you give to a chef.

The Rules: You can tell Shaperd, "Make sure every packet of data has at least 50% of the letters being standard English letters," or "Make sure the messages are exactly 100 bytes long."
The Flexibility: Unlike older tools that were stuck with one rigid design, Shaperd lets you change the recipe on the fly. If the librarian changes their rules tomorrow, you just update the recipe card, and Shaperd adapts immediately.

2. The Two-Step Tailoring Process

When your secret message arrives at Shaperd, it goes through two main stations:

Station A: The Shaper Thread (The Content Editor)
This station looks at the actual "meat" of your message. It has two tricks up its sleeve:
- Trimming: If your message is too long or has the wrong mix of characters, Shaperd chops off the excess until it fits the rules.
- Padding: If your message is too short or looks too "random," Shaperd adds extra, harmless filler bytes (like stuffing a letter with extra paper) until it looks perfect.
- Note: The paper says they currently use a simple "stuffing" method, but they plan to make it smarter later.
Station B: The Timer Thread (The Traffic Cop)
This station controls when the messages leave.
- Imagine a delivery driver who usually rushes out the door. The Timer Thread tells the driver, "Wait 2 seconds," or "Send the next package exactly 5 seconds after this one."
- This ensures the messages don't arrive in a suspiciously fast or slow rhythm. The paper notes this part is still being built and tested, but the goal is to make the timing look completely natural.

3. The Results: Fast and Light

The authors tested a prototype of Shaperd (written in a programming language called Go). They found that adding this "tailoring" service didn't slow things down much.

The Cost: It only added about 4.1% overhead.
The Analogy: Imagine you are driving a car. Adding Shaperd is like putting a small, lightweight roof rack on your car. It changes the shape slightly, but you barely notice the difference in speed or fuel consumption. Even when they added more complex rules, the slowdown was still very small.

Why This Matters

Currently, tools like Shadowsocks (a popular way to bypass censorship) are getting caught because their "fingerprints" are too obvious. Shaperd allows these tools to keep working without needing to be completely rebuilt. It acts as a universal adapter that can be plugged into any existing tool to make it harder to detect.

In Summary:
Shaperd is a real-time tool that reshapes your secret internet traffic to look like "normal" noise, fooling censors who are trying to spot patterns. It does this by letting users set custom rules for how the data looks and when it arrives, all while adding almost no delay to your connection. It is designed to be a plug-and-play upgrade for existing privacy tools.

Based on the extended abstract provided, here is a detailed technical summary of the paper "Shaperd: Easily Adoptable Real-Time Traffic Shaper for Fully Encrypted Protocols."

1. Problem Statement

Fully Encrypted Protocols (FEPs) (e.g., Shadowsocks, VMess) are critical tools for circumventing internet censorship in restrictive regions. They function by encrypting entire traffic payloads, making data appear as random bytes to hide metadata like protocol type and data length.

However, FEPs face increasing detection and blocking by censors using:

Passive Traffic Analysis: Statistical analysis of packet lengths, entropy, and the ratio of printable ASCII characters.
Active Probing: Sending probes to elicit specific responses from FEPs.
Ad-hoc Rules: Censors frequently update detection rules (e.g., blocking traffic with entropy lower than standard TLS or specific character distributions).

The Gap: Existing FEPs have rigid designs that cannot adapt to these evolving detection rules. While some prior work (e.g., Fenske et al.) addressed packet length shaping, they lacked packet timing shaping and were not designed as standalone, easily integrable solutions. There is currently no independent, real-time traffic shaper that can dynamically modify both packet content and timing to evade detection without requiring a complete rewrite of the underlying FEP.

2. Methodology: Shaperd

The authors propose Shaperd, a real-time, standalone traffic shaper designed to sit between the user and the FEP. It modifies traffic flows in real-time to satisfy user-defined constraints, effectively "morphing" the traffic to evade detection.

Core Architecture

Shaperd operates via a two-thread workflow:

Traffic Buffer: Incoming FEP traffic is stored here before processing.
Shaper Thread: Monitors the buffer and inspects packet contents. It generates new valid packets using two methods:
- Length Reduction: Truncating packet content until constraints are met (proven more effective in testing).
- Content Padding: Appending incremental byte values to packets to satisfy constraints (used as a fallback).
Timer Thread: Controls the transmission timing of packets based on timing constraints (e.g., inter-packet delays, throughput limits). Note: This component is currently a work in progress.

The Novel Constraint System

The core innovation is a flexible constraint framework that allows users to define specific traffic features. A constraint consists of four components:

Function: A deterministic metric to calculate (e.g., percentage of printable ASCII characters, entropy).
Value: The target value for the metric.
Mode: The comparison operator (e.g., $>$ , $<$ , $=$ ).
Target: Which packets the constraint applies to.

Example: A user can define a rule requiring "50% or more printable ASCII characters in every packet" to mimic normal TLS traffic and bypass specific censor rules identified by Wu et al. [22].

3. Key Contributions

Shaperd System: A real-time traffic shaper that can be easily integrated with any existing or future FEP (e.g., Shadowsocks, V2Ray) without modifying the FEP's core code.
Novel Constraint System: A flexible mechanism allowing users to define arbitrary traffic features (both content and timing) to adapt to dynamic censor detection rules.
Dual-Shaping Capability: Unlike previous tools that focused only on packet length, Shaperd aims to shape both packet content (length and byte values) and packet timing (delays and intervals).
Offloading Complexity: It allows FEP developers to focus on encryption and protocol features while offloading the complex task of traffic obfuscation to Shaperd.

4. Results and Evaluation

The authors implemented a proof-of-concept in Go (~1,000 lines of code) and tested it using a random byte generator as a traffic source.

Overhead: Shaperd introduces minimal performance overhead.
- Baseline overhead with a simple entropy constraint: 4.1%.
- With two constraints: 5.5% overhead.
Scalability: Overhead scales linearly with the number and rigor of constraints added.
Effectiveness: The length reduction method was found to be more performant than content padding in preliminary tests.

5. Significance and Future Work

Significance:
Shaperd addresses the "unobservability" challenge by providing a modular layer that makes FEPs adaptable to the "cat-and-mouse" game of censorship. By allowing traffic to be shaped to look like specific, non-random patterns (or specific random patterns), it thwarts rule-based detection that relies on static heuristics.

Future Work & Limitations:

Performance Optimization: The current "constraint-agnostic" design incurs some overhead. The authors plan to add a "type" field to constraints to help the shaper optimize processing for specific rule types.
Protocol Support: Currently supports only TCP; future versions will aim to support other protocols for broader applicability.
Advanced Evaluation: Future testing will move beyond random byte generators to integrate with state-of-the-art tools (Proteus, Shadowsocks) and use sophisticated traffic fingerprinting techniques to validate evasion capabilities against real-world censor attacks.
Timer Thread Finalization: Completing the real-time timing shaping feature to fully control packet inter-arrival times.

In conclusion, Shaperd represents a significant step toward resilient censorship circumvention by decoupling traffic shaping logic from encryption protocols, offering a flexible, low-overhead solution to dynamic detection threats.