Module 7: Statistical Traffic Morphing¶

Files: src/morph/morph.c
Header: include/qrnsp_morph.h

Problem¶

DPI increasingly uses statistical analysis: packet size distributions, inter-arrival times, burst patterns, TLS fingerprints. Protocol signatures aren't enough for detection — they profile traffic shape.

Solution¶

Learn statistical profiles of real services offline, then pad/delay/batch outgoing packets to match the target distribution at runtime.

Built-in Profiles¶

Quality Monitoring¶

Running Kolmogorov-Smirnov statistic tracks drift from target profile. KS < 0.1 = good, KS > 0.3 = DPI risk.

Cover Traffic¶

When no real data to send, generates dummy packets matching the profile to maintain continuous flow patterns.