[tor-dev] Building an automatic censorship-detection system for Tor

[Karsten Loesing]

In the past years we observed sudden drops in Tor usage in certain
countries.  Some of these events may be attributed to countries
specifically wanting to block Tor, as it enables their citizens to
circumvent their censorship infrastructure.  Other events likely result
from country-wide Internet outages that are unrelated to Tor.

Two such events happened in January 2011 in Iran [0] and Egypt [1].

The key point is that we can derive from observed Tor usage when
something potentially interesting is going on in a country.  We should
be able to build a system that keeps track of our daily user estimates
per country and automatically sends out a warning whenever there are
sudden changes.

George Danezis wrote "An anomaly-based censorship-detection system for
Tor" [2].  George's detection code [3] uses our daily user estimates [4]
as input and gives a list of sudden upturns and downturns per country as
output.  We integrated the results of his script in the metrics website
[5] to demonstrate what events the detector recognizes as possible
censorship events.

For example, the detector would have warned in January 2011 about the
events in Iran [6] and Egypt [7], shown as red dots for downturns.

However, as one can see, George's script also detects quite a few false
positives.  Whenever there's a red or blue dot, the script would have
issued a warning for a human to check.  It would be neat to reduce these
false warnings while still catching the really suspicious events.

Want to help us make our censorship-detection system better?  Any
suggestion to improve George's algorithm or to come up with an
alternative approach to detect possible censorship events in our data
would be much appreciated!  Let us know if we can help you get started.


[0]
https://metrics.torproject.org/users.html?graph=direct-users&start=2011-01-01&country=ir&#direct-users

[1]
https://metrics.torproject.org/users.html?graph=direct-users&start=2011-01-01&country=eg#direct-users

[2] https://metrics.torproject.org/papers/detector-2011-08-11.pdf

[3] https://gitweb.torproject.org/metrics-tasks.git/tree/HEAD:/task-2718

[4] https://metrics.torproject.org/csv/direct-users.csv

[5] https://metrics.torproject.org/users.html#censorship-events

[6]
https://metrics.torproject.org/users.html?graph=direct-users&start=2011-01-01&country=ir&events=on#direct-users

[7]
https://metrics.torproject.org/users.html?graph=direct-users&start=2011-01-01&country=eg&events=on#direct-users