Signature Detail

Unidentified Encrypted Traffic (Strict)

This anomaly triggers when it detects traffic that appears to be encrypted and that does not match any known protocol. This anomaly can be used to detect protocols that try to avoid detection, such as skype, bittorrent, or botnets. This version of the anomaly is the most strict, and should create the fewest false positives.