> How can you differentiate between different "types of noise"? If the traffic is cryptographically sound, the signal is indistinguishable from the noise.
I'd assume that this kind of traffic is identifiable to within near perfect certainty, which would also make it easy to block.
The situation is a bit similar to early crypto-analysis: it's totally easy to devise a cipher that makes text look random to the eye, but is still easily cracked using statistics (eg. frequency method). Just because traffic patterns look all complex and random doesn't mean that there is a meaningful amount of entropy in it (but you need a lot of entropy to hide all the metadata - who with whom and when). Just because bandwidth or packet frequency looks independent of user activity it doesn't mean that it actually is.
Message length, relative timing, average bandwidth, ports used, source/destination addresses, activity punch-card.
I'd assume that this kind of traffic is identifiable to within near perfect certainty, which would also make it easy to block.
The situation is a bit similar to early crypto-analysis: it's totally easy to devise a cipher that makes text look random to the eye, but is still easily cracked using statistics (eg. frequency method). Just because traffic patterns look all complex and random doesn't mean that there is a meaningful amount of entropy in it (but you need a lot of entropy to hide all the metadata - who with whom and when). Just because bandwidth or packet frequency looks independent of user activity it doesn't mean that it actually is.