Abhishek Vasisht Bhaskar

PhD Candidate, Computer Science
School of Cybersecurity and Privacy
Georgia Institute of Technology

Committee:

Dr. Paul Pearce (advisor) - School of Cybersecurity and Privacy, Georgia Institute of Technology
Dr. Michael Bailey - School of Cybersecurity and Privacy, Georgia Institute of Technology
Dr. Frank Li - School of Cybersecurity and Privacy, Georgia Institute of Technology
Dr. Alberto Dainotti - School of Computer Science, Georgia Institute of Technology
Dr. Michael Specter - School of Cybersecurity and Privacy, Georgia Institute of Technology

Abstract:

Internet measurement enables researchers to study critical problems, such as botnets, vulnerabilities, and Internet censorship, at global scale. Prior work has largely focused on improving measurement scale and speed, with elements of reliability and correctness being largely neglected. In particular, censorship measurement has frequently observed non-determinism and inconsistency that has not been systematically explained. In this thesis, we develop empirical methods and systems to evaluate factors that influence censorship measurement results, showing that routing dynamics, packet parameters, measurement direction, and IP version all significantly influence censorship results.

We begin by showing that external DNS censorship measurement in China is directly impacted by Equal-Cost Multi-Path (ECMP) routing induced by packet header fields like source IP and port. We find that 37% of IPs across 56% of ASes exhibit changes in observed censorship, and magnitude of censorship differences can more than double based on part of the source IP, consistent with known router load balancing techniques. We then generalize this result globally, finding routing-induced variation across DNS, HTTP, and HTTPS in 17 of 21 countries studied. These differences arise from multiple sources, including intra-AS and inter-AS routing differences, path diversity to the same destination, and geographically non-uniform censorship deployment, demonstrating that the problem is not unique to China or a single protocol. Finally, we develop a unified measurement framework spanning inside-out and outside-in measurements over both IPv4 and IPv6, showing that remote measurements can observe disruption in 21 countries without requiring in-country resources, that IPv6 disruption is less prevalent than IPv4 though still present, and that routing- and parameter-induced variation persists across measurement direction and IP version.

All told, this thesis shows that Internet censorship measurement results are not only influenced by methodological choices, but also by seemingly benign network behaviors unrelated to censorship itself, such as routing dynamics and on-path behavior. Measurement direction, IP version, routing path, and packet construction can all influence observed results, leading to variation across measurements of the same destinations. We further show that censorship observed along a path toward a destination is not necessarily the same as censorship at the destination itself, as externally observed disruption can be introduced by on-path behavior. Taken together, these results establish the need for more rigorous, route-aware, and methodologically controlled approaches to censorship measurement, and provide concrete guidance for designing studies that are more reliable, consistent, and interpretable.