Packet capture. The server captures the first 6–10 TCP/IP packets
of your incoming connection, including every TCP and IP header field.
Feature extraction. Packet sizes, inter-arrival times, TCP flags, window
sizes and other header fields become numerical features for the classifier.
Random forest classification. A pre-trained random forest model, trained
on thousands of real proxy and non-proxy connections, classifies the traffic pattern as proxy or
non-proxy.
Completely passive. No JavaScript, no WebSocket, no client-side code. The
classifier works purely from the server-side TCP/IP traffic, so a browser extension cannot evade it.
