What three techniques does a censorship system use to inspect traffic, and what can each detect?

A stateful firewall tracks connection context; Deep Packet Inspection reads packet contents/metadata up to the application layer; flow-based analysis spots patterns over time using machine learning.

• Stateful Firewall: modern firewalls understand the context between packets — they can follow complete TCP handshakes and connection states, not just individual packets in isolation.
• Deep Packet Inspection (DPI): analyses packet metadata and contents up to the application layer, identifying even encrypted connections by their patterns and classifying traffic types.
• Flow-based analysis: recognises traffic patterns over long time spans — number/type of connections between IPs and networks, data volumes, timing patterns, deviations from normal behaviour. Machine learning is used to spot VPN and proxy traffic.

Tip: Encryption hides content, but flow analysis attacks shape — packet sizes, timing, and volume. That's why a censor can flag "this looks like a VPN" without decrypting a single byte.

Go deeper:

• Deep packet inspection (Wikipedia) — the core DPI technique among the three inspection methods.