In the past years we observed sudden drops in Tor usage in certain countries. Some of these events may be attributed to countries specifically wanting to block Tor, as it enables their citizens to circumvent their censorship infrastructure. Other events likely result from country-wide Internet outages that are unrelated to Tor.
Two such events happened in January 2011 in Iran [0] and Egypt [1].
The key point is that we can derive from observed Tor usage when something potentially interesting is going on in a country. We should be able to build a system that keeps track of our daily user estimates per country and automatically sends out a warning whenever there are sudden changes.
George Danezis wrote "An anomaly-based censorship-detection system for Tor" [2]. George's detection code [3] uses our daily user estimates [4] as input and gives a list of sudden upturns and downturns per country as output. We integrated the results of his script in the metrics website [5] to demonstrate what events the detector recognizes as possible censorship events.
For example, the detector would have warned in January 2011 about the events in Iran [6] and Egypt [7], shown as red dots for downturns.
However, as one can see, George's script also detects quite a few false positives. Whenever there's a red or blue dot, the script would have issued a warning for a human to check. It would be neat to reduce these false warnings while still catching the really suspicious events.
Want to help us make our censorship-detection system better? Any suggestion to improve George's algorithm or to come up with an alternative approach to detect possible censorship events in our data would be much appreciated! Let us know if we can help you get started.
[0] https://metrics.torproject.org/users.html?graph=direct-users&start=2011-...
[1] https://metrics.torproject.org/users.html?graph=direct-users&start=2011-...
[2] https://metrics.torproject.org/papers/detector-2011-08-11.pdf
[3] https://gitweb.torproject.org/metrics-tasks.git/tree/HEAD:/task-2718
[4] https://metrics.torproject.org/csv/direct-users.csv
[5] https://metrics.torproject.org/users.html#censorship-events
[6] https://metrics.torproject.org/users.html?graph=direct-users&start=2011-...
[7] https://metrics.torproject.org/users.html?graph=direct-users&start=2011-...