Abstract
Two main methods of traffic analysis are known [1]: packet analysis (packet-based), which, in turn, is subdivided into surface, medium and deep analysis (SPI, MPI, DPI), and flow analysis (flow-based), selectable or aggregated by specified criteria.It should be emphasized that flow analysis is currently used more often than packet analysis, since this method imposes fewer requirements on the resources used, due to a significant reduction in the amount of computation for processing.In addition, in recent years, there have been more and more statements about the inadmissibility and illegality of deep packet analysis, since it