Protocol camouflage is a technique where malicious network traffic is shaped to look like a legitimate protocol or service. Instead of using obviously suspicious beacons, an attacker may copy the packet format, timing, ports, or message flow of common traffic such as HTTP, DNS, STUN, or WebSocket. The goal is to blend in with normal activity and avoid simple detection rules that depend on known bad signatures or blocked ports.
This matters because many security controls trust familiar protocol patterns. If command-and-control traffic resembles ordinary application or NAT-traversal traffic, it may pass through firewalls, proxies, and allowlists unnoticed. Defenders counter it with protocol-aware monitoring, baselining, deep packet inspection, and behavior analysis that checks whether the content, timing, and destination truly fit the claimed protocol. In practice, camouflage often leaves subtle clues: malformed fields, unusual packet sizes, odd retry patterns, or destination servers that do not match expected business use.