...For passive testing, the flow of the Trojan agreement is completely consistent with the characteristics and behavior of the HTTPS flow. HTTPS traffic accounts for more than half of current Internet traffic, and the traffic is confidential after TLS's handshake is successful. There is almost no feasible way to distinguish Trojan protocol traffic from it.