...Contrary to Shadowsoks, Trojan does not use self-defined encryption protocols to hide itself. On the contrary, the clearly characterized TLS protocol (TLS/SSL) is used to make the flow look the same as the normal HTTPS website. TLS is a mature encryption system, and HTTPS uses TLS to carry HTTP traffic. For passive testing, the flow of the Trojan agreement is completely consistent with the characteristics and behavior of the HTTPS flow. HTTPS traffic accounts for more than half of current Internet traffic, and the traffic is confidential after TLS's handshake is successful. ...