Method and Algorithm for Determining the Type of Traffic in an Encrypted Communication Channel

Abstract

The article proposes a method for determining the composition of protocols used in IPsec communication channel, based on the regularities of the chronology and the lengths of encrypted load packets. The characteristic informative features of the protocols are considered. An algorithm is given to obtain the length values of ESP packets containing arbitrary user data for common modes of IPsec tunnel operation.