AI and ML in VPN detection: what works, what's hype

What people actually mean by “AI” in this space

Four different things hide under the same label:

• Signature matching. JA3/JA4 fingerprint hashes against a known database. Useful, not AI. The technique is decades old. The hash is computed from fixed fields in the TLS ClientHello; there is no model to train.
• Hand-tuned weighted scoring. A set of signals — provider-list match, ASN class, active probe, threat-intel hit — combined with weights an engineer chose. IPLogs sits here. Verdicts are deterministic and auditable.
• Statistical heuristics. Algorithms like the SNITCH paper's TCP-vs-TLS RTT differential. Mathematical models with published thresholds from peer-reviewed research, not models trained on a labelled corpus. The line between “heuristic” and “ML” is fuzzy, but transparency is the test — if you can explain the model in a paper, it isn't a black box.
• Trained classifiers. A model that learned its weights from a labelled corpus, typically a gradient-boosted tree or a small neural net over behavioural features. This is the only category that honestly deserves the “ML” label. A few vendors ship this well; many ship it badly and don't publish error rates against any independent benchmark.

Where ML actually helps

Trained classifiers earn their place when the relationship between input and answer is too noisy to capture with hand-written weights. Three honest examples:

• Behavioural velocity scoring. Per-account request rate, geographical jumps per session, ratio of failed-to-successful login attempts. The features interact non-linearly and the right thresholds vary by product. A gradient-boosted tree over a labelled corpus typically beats a hand-tuned rule set here.
• Behavioural residential-proxy detection. The IP-layer signals for a residential proxy and a real consumer are identical. Telling them apart requires session-level patterns — concurrent country jumps for the same account, IP-velocity, session-fingerprint mismatch. That's ML territory, and the vendors investing in it are real.
• Anomaly detection on traffic patterns. CDN-scale providers train models that flag unusual access patterns against a baseline of normal traffic. Useful, but hard to do correctly outside the data-volume bracket of large CDNs.

Where ML hurts: the black-box-score problem

An ML model that returns a single score with no per-signal provenance creates a real product problem. When your fraud team blocks a customer because “the model said so,” they cannot tell whether the cause was a CGNAT collision, an Apple Private Relay miss, a residential proxy on a neighbour's router, or a real fraud signal. The customer cannot dispute usefully and your operator cannot triage. The same critique applies to opaque IP-reputation scores — a number is not a decision, and a decision without a reason is hard to defend.

Why IPLogs uses deterministic weighted signals

IPLogs ships a multi-source pipeline with hand-tuned weights:

The trade-off is real. A trained classifier can capture interactions that hand-written weights cannot, particularly once you add behavioural signals at session granularity. The counter-argument is that an IP-level detector with published weights and a published false-positive rate is auditable; a trained classifier with no per-decision explanation is not. Where the right balance sits is product-specific. IPLogs chooses the auditable end because consumers of the API are also engineers who need to defend the decisions to their own users.

Cited research worth reading directly

• SNITCH (NDSS 2025) — TCP vs TLS RTT differential. Background reading on the timing-based detection that IPLogs integrates. Verify any specific claim against the published paper before treating it as fact.
• JA3 and JA4 fingerprint specifications. JA3 was originally published by Salesforce engineering; JA4 is the newer FoxIO format with a richer hash. Read the specs, not vendor blog posts about them.
• Anti-censorship protocol papers. The IPLogs blog covers REALITY, Xray, and AmneziaWG at the implementation level. The underlying protocol papers are the right primary source if you're building detection for them.

FAQ