Methods, systems, and devices are disclosed for detecting encrypted
Internet Protocol packet streams. An encrypted stream of packets is
received, with the encryption obscuring the type of data within the
stream of packets. The type of data contained within the encrypted stream
of packets is inferred using at least one of i) a set of variables
comprising at least one of an observable parameter, a threshold value, a
range of values, a timer, and an algorithm, and ii) multiple processes.
Varying the selection of the variables thwarts hacking attempts, and the
multiple processes enhance effectiveness and reliability.