The possibility of using artificial intelligence to find and block VPN services was discussed in Russia. One of the draft national plans until 2030 included the goal of achieving 95% blocking efficiency. However, the Ministry of Digital Development stated that the current version of the document does not contain such a provision.
According to Kommersant, departments proposed using AI to analyze the characteristics of up to 70% of VPN services planned for blocking. This involved identifying features of network traffic that could indicate a connection is passing through a VPN.
Currently, intelligent algorithms are already used for analyzing internet traffic, but, according to a source familiar with the discussion of the initiative, they are not considered artificial intelligence. Roskomnadzor did not respond to journalists' inquiries.
AI can search for VPNs not only by known server addresses
Algorithms are capable of analyzing indirect signs of a connection: the size and frequency of data packet transmission, session duration, the ratio of incoming and outgoing traffic, and the specifics of server operation and neighboring network addresses. This would allow for faster detection of new services not yet included in blocking lists.
However, this approach has a downside, experts said. Regular internet services sometimes use network schemes similar to those characteristic of VPNs. Therefore, the system might mistake a legitimate connection for an attempt to bypass blocks.
Kommersant's source in the network market estimated the current error rate for analysis and blocking at 5–6%. According to him, a small percentage of errors when processing a huge volume of traffic can lead to the blocking of a large number of legitimate connections.
Sergey Kudryashov, Partner of the 'Digital Transformation' practice at Strategy Partners, noted that corporate VPNs, cloud services, and voice traffic can have statistical characteristics similar to traffic used to bypass restrictions.
To reduce the number of erroneous blocks, experts suggest using AI as the first stage of verification, rather than as the sole decision-making mechanism. The system could flag suspicious addresses, which would then be additionally checked before blocking.
For such a system to function fully, according to experts, deep packet inspection equipment on operator networks alone will not be enough. Infrastructure for collecting and storing large volumes of network data, computing power for training and retraining models, and a mechanism for updating algorithms at filtering nodes will be needed.