... to make the flow look the same as the normal HTTPS website. TLS is a mature encryption system, and HTTPS uses TLS to carry HTTP traffic. For passive testing, the flow of the Trojan agreement is completely consistent with the characteristics and behavior of the HTTPS flow. HTTPS traffic accounts for more than half of current Internet traffic, and the traffic is confidential after TLS's handshake is successful. There is almost no feasible way to distinguish Trojan protocol traffic from it.