  As the size and source of network traffic increase, so does the challenge of
monitoring and analysing network traffic. Therefore, sampling algorithms are
often used to alleviate these scalability issues. However, the use of high
entropy data streams, through the use of either encryption or compression,
further compounds the challenge as current state of the art algorithms cannot
accurately and efficiently differentiate between encrypted and compressed
packets. In this work, we propose a novel traffic classification method named
HEDGE (High Entropy DistinGuishEr) to distinguish between compressed and
encrypted traffic. HEDGE is based on the evaluation of the randomness of the
data streams and can be applied to individual packets without the need to have
access to the entire stream. Findings from the evaluation show that our
approach outperforms current state of the art. We also make available our
statistically sound dataset, based on known benchmarks, to the wider research
community.
