Thousands of diverse applications and services flow daily over networks used by governments, industry, and private users. Attacks can be hidden within these information flows by disguising malicious network traffic to appear to be legitimate. Generally, TCP or UDP based protocols can be mapped to specific network services. However, intruders do hide unauthorized activity by using non-standard protocols or standard protocols in non-standard ways to avoid detection. This paper describes current work and future directions that the Network Security Research Group at the Communication Research Centre (CRC) will take to identify flows of information that disguise attacks. Research challenges include uncovering unauthorized activities in high-speed, high-volume network links and within protocols that are intended to obscure the details of the information carried.