There is an existing "psiphon" Application ID with a risk score of 5 (not sure when it was added). Presumably you could identify the traffic by application and drop/reset it automatically in a rule once detected. We have an explicit drop rule for all applications with a risk score of 5.