<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-network-baseline-analysis
description: >-
  Establish network traffic baselines and detect anomalies through flow analysis,
  protocol distribution, bandwidth profiling, and connection pattern modeling.
  Covers NetFlow, Zeek, and SIEM-based network analytics.
domain: cybersecurity
subdomain: blue-team
tags:
  - network-monitoring
  - baseline-analysis
  - netflow
  - zeek
  - anomaly-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1046", "T1071"]
---

# Performing Network Baseline Analysis

## Overview

Network baseline analysis establishes normal traffic patterns so deviations become
detectable. Without a baseline, distinguishing malicious traffic from legitimate
activity is guesswork. This skill covers flow data collection, statistical profiling,
anomaly detection, and ongoing baseline maintenance.

## Prerequisites

| Requirement | Install |
|---|---|
| Zeek | `zeek -i eth0` for network monitoring |
| NetFlow collector | nfdump, SiLK, or Elastic NetFlow |
| SIEM with network data | Indexed flow/connection logs |
| Python 3.10+ | Statistical analysis |
| pandas | `pip install pandas` for data analysis |

## Key Concepts

### Baseline Dimensions

| Dimension | Metric | Normal Range |
|---|---|---|
| Bandwidth | Bytes/sec per segment | Weekday/weekend profiles |
| Protocol distribution | % TCP/UDP/ICMP | Stable ratio (±5%) |
| Top talkers | Top 10 source IPs by bytes | Consistent set of servers |
| Connection patterns | Connections/min per host | Predictable for servers |
| Port usage | Active destination ports | Known service ports |
| DNS query volume | Queries/min per host | 5-50 for workstations |
| External connections | Unique external IPs/day | Bounded by business need |

### Zeek Log Analysis

```bash
# Connection summary by protocol
cat conn.log | zeek-cut proto | sort | uniq -c | sort -rn

# Top talkers by bytes transferred
cat conn.log | zeek-cut id.orig_h orig_bytes | \
  awk '{sum[$1]+=$2} END {for (k in sum) print sum[k], k}' | sort -rn | head 20

# Long-duration connections (potential C2 beacons)
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration | \
  awk '$4 > 3600' | sort -t$'\t' -k4 -rn | head 20

# Rare destination ports
cat conn.log | zeek-cut id.resp_p | sort | uniq -c | sort -n | head 20
```

### SIEM Baseline Queries

```spl
| -- Bandwidth baseline by hour of day
index=netflow earliest=-30d
| eval hour=strftime(_time, "%H"), dow=strftime(_time, "%u")
| stats avg(bytes) AS avg_bytes, stdev(bytes) AS std_bytes by hour, dow
| eval upper_bound=avg_bytes + (2 * std_bytes)

| -- Protocol distribution baseline
index=netflow earliest=-30d
| stats count by protocol
| eventstats sum(count) AS total
| eval pct=round(count/total*100, 2)

| -- Detect new external connections (never seen before)
index=firewall action=allow direction=outbound earliest=-1d
| stats count by dest_ip
| search NOT [
    search index=firewall action=allow direction=outbound earliest=-31d latest=-1d
    | stats count by dest_ip
    | fields dest_ip
  ]
| sort -count
```

### Statistical Anomaly Detection

```python
import pandas as pd
import numpy as np

def detect_anomalies(df: pd.DataFrame, column: str, window: int = 7) -> pd.DataFrame:
    """Detect anomalies using rolling z-score."""
    rolling_mean = df[column].rolling(window=window).mean()
    rolling_std = df[column].rolling(window=window).std()
    df["zscore"] = (df[column] - rolling_mean) / rolling_std
    df["anomaly"] = df["zscore"].abs() > 3
    return df[df["anomaly"]]
```

## Workflow

1. **Collect flow data** — Enable NetFlow/Zeek on key network segments
2. **Profile normal** — Aggregate 30 days of traffic by dimension
3. **Calculate baselines** — Compute mean, std dev, percentiles per metric
4. **Set thresholds** — Define anomaly as >2-3 standard deviations
5. **Build dashboards** — Visualize baselines with anomaly overlays
6. **Alert on deviation** — Trigger alerts when metrics exceed thresholds
7. **Review weekly** — Update baselines to account for business changes
8. **Investigate** — Triage anomalies through SOC workflow

## Detection

```yaml
title: Network Baseline Analysis Detection
id: 43dca17f-b003-46b6-9d53-e1be33744dea
status: experimental
description: Detects suspicious activity related to performing network baseline analysis techniques in blue team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*network*"
  condition: selection
level: medium
tags:
  - attack.t1046
  - attack.t1071
  - attack.defense_evasion
falsepositives:
  - Security team running authorized detection validation tools
```

## Verification

| Check | Method |
|---|---|
| Flow data collected | NetFlow/Zeek logs indexed in SIEM |
| Baselines calculated | 30-day metrics computed per dimension |
| Anomaly detection active | Test with synthetic traffic spike |
| Dashboards operational | Visual baseline with deviation overlay |
| Alerts configured | Threshold breach triggers SOC alert |

## References

- [Zeek Network Monitor](https://docs.zeek.org/)
- [NetFlow RFC 5101](https://datatracker.ietf.org/doc/html/rfc5101)
- [SANS Network Forensics Poster](https://www.sans.org/posters/network-forensics/)
- [SiLK Analysis Suite](https://tools.netsa.cert.org/silk/)
