Traffic analysis Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication . It can be performed even when the messages are encrypt ed and cannot be decrypted . In general , the greater the number of messages observed , or even intercepted and stored , the more can be inferred from the traffic . Traffic analysis can be performed in the context of military intelligence or counter - intelligence , and is a concern in computer security . Traffic analysis tasks may be supported by dedicated computer software programs , including commercially available programs such as those offered by i2 , Visual Analytics , Memex , Orion Scientific , Pacific Northwest National Labs , Genesis EW ' s GenCOM Suite , SynerScope and others . Advanced traffic analysis techniques may include various forms of social network analysis . In military intelligence . In a military context , traffic analysis is a basic part of signals intelligence , and can be a source of information about the intentions and actions of the enemy . Representative patterns include : There is a close relationship between traffic analysis and cryptanalysis ( commonly called codebreaking ) . Callsign s and addresses are frequently encrypt ed , requiring assistance in identifying them . Traffic volume can often be a sign of an addressee ' s importance , giving hints to pending objectives or movements to cryptanalysts . Traffic flow security . Traffic - flow security is the use of measures that conceal the presence and properties of valid messages on a network to prevent traffic analysis . This can be done by operational procedures or by the protection resulting from features inherent in some cryptographic equipment . Techniques used include : Traffic - flow security is one aspect of communications security . COMINT metadata analysis . The Communications ' Metadata Intelligence , or COMINT metadata is a term in communications intelligence ( COMINT ) referring to the concept of producing intelligence by analyzing only the technical metadata , hence , is a great practical example for traffic analysis in intelligence . While traditionally information gathering in COMINT is derived from intercepting transmissions , tapping the target ' s communications and monitoring the content of conversations , the metadata intelligence is not based on content but on technical communicational data . Non - content COMINT is usually used to deduce information about the user of a certain transmitter , such as locations , contacts , activity volume , routine and its exceptions . Examples . For example , if a certain emitter is known as the radio transmitter of a certain unit , and by using direction finding ( DF ) tools , the position of the emitter is locatable ; hence the changes of locations can be monitored . That way we ' re able to understand that this certain unit is moving from one point to another , without listening to any orders or reports . If we know that this unit reports back to a command on a certain pattern , and we know that another unit reports on the same pattern to the same command , then the two units are probably related , and that conclusion is based on the metadata of the two units ' transmissions , and not on the content of their transmissions . Using all , or as much of the metadata available is commonly used to build up an Electronic Order of Battle ( EOB ) – mapping different entities in the battlefield and their connections . Of course the EOB could be built by tapping all the conversations and trying to understand which unit is where , but using the metadata with an automatic analysis tool enables a much faster and accurate EOB build - up that alongside tapping builds a much better and complete picture . In computer security . Traffic analysis is also a concern in computer security . An attacker can gain important information by monitoring the frequency and timing of network packets . A timing attack on the SSH protocol can use timing information to deduce information about password s since , during interactive session , SSH transmits each keystroke as a message . The time between keystroke messages can be studied using hidden Markov model s . Song , " et al . " claim that it can recover the password fifty times faster than a brute force attack . Onion routing systems are used to gain anonymity . Traffic analysis can be used to attack anonymous communication systems like the Tor anonymity network . Adam Back , Ulf Möeller and Anton Stiglic present traffic analysis attacks against anonymity providing systems . Steven J . Murdoch and George Danezis from University of Cambridge presented research showing that traffic - analysis allows adversaries to infer which nodes relay the anonymous streams . This reduces the anonymity provided by Tor . They have shown that otherwise unrelated streams can be linked back to the same initiator . Remailer systems can also be attacked via traffic analysis . If a message is observed going to a remailing server , and an identical - length ( if now anonymized ) message is seen exiting the server soon after , a traffic analyst may be able to ( automatically ) connect the sender with the ultimate receiver . Variations of remailer operations exist that can make traffic analysis less effective . Countermeasures . It is difficult to defeat traffic analysis without both encrypting messages and masking the channel . When no actual messages are being sent , the channel can be masked . " It is very hard to hide information about the size or timing of messages . The known solutions require Alice to send a continuous stream of messages at the maximum bandwidth she will ever use . . . This might be acceptable for military applications , but it is not for most civilian applications . " The military - versus - civilian problems applies in situations where the user is charged for the volume of information sent . Even for Internet access , where there is not a per - packet charge , ISPs make statistical assumption that connections from user sites will not be busy 100 % of the time . The user cannot simply increase the bandwidth of the link , since masking would fill that as well . If masking , which often can be built into end - to - end encryptors , becomes common practice , ISPs will have to change their traffic assumptions .