Abstract: In a cyphertext (CT) network, a method for detecting anomalies comprising analyzing cyphertext data flows within the CT network where the CT network includes one or more encryption devices for encrypting plaintext data packets into cyphertext data packets such that the cyphertext data flows are directed to one or more destination devices. The cyphertext data includes multiple CT data packets and each CT data packet includes header information where each header includes source address information, destination address information and differentiated service code point (DSCP) information representative of traffic class information. The method further includes analyzing the traffic class information of each header, including using maximum entropy estimation for detecting one or more anomalies within the traffic class distribution of each flow based on the header information for that traffic class.