New means of communication are constantly emerg- ing, some of which may constitute resource mis- use of an organisation?s network system. Identify- ing the protocols used is straight-forward when in- specting network logs, but we focus on the problem of identifying the underlying protocol present in an unknown TCP connection. Actions are difficult to detect if the underlying protocol is encrypted and tunneled through a proxy server or SSH. We use a graph-comparison approach to build profiles of sev- eral protocols, and attempt to classify an unknown, encrypted protocol against these profiles using only the visible behaviour of the protocol being tunneled-- the size, timing and direction of packets.