Detecting Internet Filtering from Geographic Time Series

Motivated by the desire to detect automatically instances of internet filtering and censorship, we propose an approach based on principle component analysis to identify per-country anomalous periods in the usage of censorship circumvention tools, and demonstrate the applicability of this approach with global usage statistics from the Tor Project. Our technique is presented as a tool that automatically highlights periods of anomalous usage of Tor on a per-country basis and ranks countries’ level of anomalous behaviour over given time periods, but is also applicable to usage data of other services. In contrast to previous country-specific investigations, the technique presented here uses deviation from expected patterns of behaviour, calculated on a per-country basis, to identify countries whose usage of Tor have deviated from those of similarly behaving countries. We demonstrate the effectiveness of this approach against known historical filtering events as well as synthetically injected anomalous events, and evaluate the sensitivity of this technique against different classes of usage anomaly. Our results suggest that patterns of usage of circumvention tools, such as the Tor Project, act not only as direct indicators of network filtering but also as a meaningful proxy variable for related events, such as protests or political unrest, in which internet use is restricted.