Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?
On Inferring Application Protocol Behaviors in Encrypted Network Traffic