IDS: how to detect http tunnel?

[bobr () guru virtual sk]

hi,
  my environment here is squid/linux serving 1000 users. i need to detect
any proxy request which could be a http tunnel connection (e.g. p2p). 
can anyone give me hint which IDS or tool (e.g. squid patch) 
(free or commercal) can detect suspicious proxy connections, or send me 
weblink to tech. paper on this topic?

thank you

bobr.