>The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis

I was under the impression that this was a man on the side attack, so they'd sent a bogus SYN-ACK back to you the moment that they saw a SYN. Theoretically, you should still only be dealing with one RTT.

>(and if there was concern, appropriate amounts of random delay and noise could be added).

I don't think China cares if it gets traced back to them.