A method to determine if an encrypted flow of packets (F) belongs to a predefined class of flows (ωt), comprises the steps of giving probability density functions (p(xi|ωt)) of the values of two measurable variables in a plurality of encrypted flows of packets (Fj) belonging to the predefined class of flows (ωt), measuring the values (si,Δt1) of the two measurable variables, apply the measured values (si,Δt1) to the probability density functions (p(xi|ωt)) to generate a sequence of values of probability density (p({right arrow over (x)}|ωt)), process the sequence of values of probability density (p({right arrow over (x)}|ωt)) to generate a reference value (S({right arrow over (x)}|ωt)), and compare such reference value (S({right arrow over (x)}|ωt)) to a threshold value (T) to determine whether the encrypted flow of packets (F) belongs to the predefined class of flows.