Protocol masquerading is the practice of making malicious traffic look like a legitimate protocol exchange. Instead of using an obviously suspicious port or payload, attackers copy the structure, timing, or fields of a trusted protocol so their traffic blends in with normal network activity. The goal is to bypass simple filtering and reduce the chance that defenders will notice command-and-control, data theft, or covert routing.
This matters because many security controls trust common infrastructure protocols by default. In real attacks, malware may wrap commands inside STUN-like, DNS-like, or HTTPS-like messages, or imitate packet patterns that resemble routine service traffic. Defenders look for mismatches between expected protocol behavior and actual content: unusual field values, invalid session logic, odd destinations, non-random identifiers, or devices using a protocol they should never need. Effective detection depends on understanding protocol semantics, not just recognizing the protocol name.