Here we investigate the extent to which common Internet application protocols remain dis- tinguishable even when packet payloads and TCP headers have been stripped away, leaving only extremely lean data which includes nothing more than the packets’ timing, size, and direction. We begin our analysis in §3 by exploring protocol recognition techniques for traffic aggregates where all flows carry the same application protocol. We then develop tools to enhance the initial analysis pro- vided by these first tools by addressing more specific scenarios. In §4, we relax the single-protocol assumption and address protocol recognition with very lean data on individual TCP connections. These methods might be used.
