Traffic concealment is the use of network techniques that make malicious activity look normal, blend in with common services, or become harder to trace. Attackers may tunnel commands through familiar protocols, reuse trusted ports, pad or encrypt data, or route traffic through intermediate hosts so the true source and destination are less obvious.
In cyber security, this matters because defenders often rely on patterns in logs, proxies, and network flows to spot command-and-control, data theft, or lateral movement. If malicious traffic looks like ordinary web traffic or arrives through a relay, it can evade simple filtering and slow attribution. Common defenses include inspecting long-lived sessions, correlating endpoint and network telemetry, flagging unusual use of web protocols, and looking for hosts that begin forwarding traffic outside their normal role.