Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?
A flow based approach for SSH traffic detection