How did GFW block circumvention tools during the 19th people's congress?

From around Oct 9th 2017 and especially during the 19th people's congress, GFW blocked almost all circumvention tools including Shadowsocks, Lantern and Psiphon. Currently, there has been no concrete findings on how exactly GFW blocks such tools.

A few hypothesis are follows.
GFW fingerprints popular circumvention protocols such as Shadowsocks, Obfs4 and HTTPS.
GFW did traffic analysis using metadata such as amount of data transferred between IP and flag them for manual review or randomly block them.

Please feel free to add new hypothesis and add data to prove/disprove any hypothesis.

[Zsnitm40]

It's nothing new, I believe it is the Quality of Service referred to on the active filtering at https://en.wikipedia.org/wiki/Great_Firewall#Active_Filtering It states that it scores each IP based on how suspicious the connection is. The only difference is that the GFW turned up the sensitivity nob.