According to at least one aspect of the present disclosure a method for detecting tunneled or multiplexed flows is provided. The method comprises: receiving an input; responsive to receiving the input, extracting a set of attributes of the input flow; responsive to extracting the set of attributes, reducing the dimensionality of the set of attributes to produce a reduced attribute set; responsive to producing the reduced attribute set, producing an output based on the reduced attribute set and a model; responsive to producing the output, comparing the output to the input to determine an error or loss; and responsive to determining the error or loss, categorizing the input as a multiplexed flow based on a threshold error or loss value.