Hi,

These are well identified issues. We've been working here on a way to
improve the current filtering detection approach, and several of the
points above are things that we're actively hoping to work into our
approach. Differentiating 'filtering' from 'other events that affect Tor
usage' is tricky, and will most likely have to rely on other
measurements from outside Tor. We're currently looking at ways to
construct models of 'normal' behaviour in a way that incorporates
multiple sources of data.

We have a paper up on arXiv that might be of interest. I'd be interested
to be in touch with anyone who's actively working on this. (We have
code, and would be very happy to work on getting it into production.)
I've shared the paper with a few people directly, but not here on the
list.

arXiv link: http://arxiv.org/abs/1507.05819

We were looking at any anomalies, not only pure Tor-based filtering
events. For the broader analysis, significant shifts in Tor usage are
very interesting. It's therefore useful to detect a range of unusual
behaviours occurring around Tor, and have a set of criteria within that
to allow differentiating 'hard' filtering events from softer anomalies
occurring due to other factors.

Joss
--
Dr. Joss Wright | Research Fellow
Oxford Internet Institute, University of Oxford
http://www.oii.ox.ac.uk/people/?id=176