An alternative protocol is a different communication channel used when a system cannot, or should not, use its primary internet path. In cyber security, the term often describes data moving over a secondary route such as peer-to-peer links, local wireless features, or another app-mediated transport instead of direct outbound traffic to a server.
This matters because many defenses are built to inspect web traffic, DNS, and firewall egress. If malware switches to an alternative protocol, it may bypass those controls and move data in a way that looks like normal local device communication. Attackers use this to improve resilience, while defenders look for unusual permissions, unexpected nearby-device activity, odd peer discovery, and traffic patterns that do not match legitimate app behavior. In short, an alternative protocol is a fallback path that can keep exfiltration alive when the obvious route is blocked.