Ivan Nardi 3326fa258e

Add an heuristic to detect fully encrypted flows (#2058) ...

A fully encrypted session is a flow where every bytes of the
payload is encrypted in an attempt to “look like nothing”.
The heuristic needs only the very first packet of the flow.
See: https://www.usenix.org/system/files/sec23fall-prepub-234-wu-mingshi.pdf

A basic, but generic, inplementation of the popcpunt alg has been added

2023-07-26 09:09:12 +02:00

135 KiB

Raw History

View raw