Baseline (Baselining)

A baseline is a statistical picture of how an IT environment — the network, servers, and users — behaves when everything is normal. It is built from telemetry collected over a stretch of time treated as representative. Baselining is the process of building that baseline and keeping it up to date. The baseline acts as a reference point: current activity is compared against it, and clear deviations are treated as anomalies worth investigating. It is a bit like knowing the daily rhythm of a household — once you know who usually comes and goes, and when, it is easier to notice that something is off. Without a reliable baseline, anomaly detection loses its meaning, because you cannot recognize a deviation if you do not know what normal looks like.

How is a baseline created?

A baseline is built from telemetry collected long enough to capture how traffic naturally rises and falls — across the day, the week, and the seasons. Machine learning-based systems usually need about 2–4 weeks of normal traffic to settle on a dependable model. The typical process looks like this:

1. Data collection — traffic flows (NetFlow, IPFIX, sFlow), logs, SNMP metrics, full-traffic metadata (e.g. Zeek), and events from hosts and identities.
2. Defining reference metrics — how much traffic there is and how fast, which ports and protocols are in use, which source–destination pairs, who talks the most (top talkers), how long connections last, latency, packet loss, jitter, and DNS query patterns.
3. Pattern analysis — statistical methods (mean, standard deviation, percentiles) or ML algorithms work out the expected ranges and thresholds.
4. Persistence and versioning — a model of normal emerges and is refreshed periodically, because the network keeps changing: new applications, new users, and infrastructure changes.

Performance baseline vs. security baseline

In practice, the same baseline is viewed from two complementary angles:

• Performance baseline (NPM) — typical traffic across the day and week, the heaviest applications, and normal levels of latency, jitter, and errors. It helps catch drops in performance and plan capacity.
• Security baseline (NDR/SOC) — which services hosts usually connect to, which way traffic flows (north-south versus east-west), and how users typically use their access. It helps detect threats: traffic on unusual ports, unknown outbound connections, and lateral movement between machines.

How does a baseline support anomaly detection?

The idea is simple and comparative: the system keeps collecting telemetry and measures it against the baseline. When a deviation crosses an acceptable threshold, the event is flagged as an anomaly. For example, if a server normally talks only on ports 80 and 443, a sudden outbound connection on 22 (SSH) or 3389 (RDP) will stand out right away against the norm. Statistically, three types of anomalies are distinguished:

• Point anomalies — a single abnormal observation, e.g. a one-off massive transfer.
• Contextual anomalies — behavior that is normal in itself but happens at the wrong time, e.g. an admin login at 3 a.m.
• Collective anomalies — a run of individually harmless events that together signal a problem, e.g. slow data exfiltration over DNS.

In practice, anomalies are also sorted by what changed — volume, timing, protocol, or behavior — and by direction. North-south is traffic crossing the network boundary, while east-west is internal traffic, which is key to detecting lateral movement.

What methods determine the norm and deviations?

• Statistical / threshold — fast and easy to understand, based on deviation from an average. The downside: they easily raise false alarms when traffic shifts for perfectly legitimate reasons.
• Unsupervised ML — clustering, Isolation Forest. Good against novel threats, but they need careful tuning.
• Supervised ML — precise for known attack types, but blind to ones they have not seen before.
• Semi-supervised / deep learning — autoencoders, LSTM networks. They capture patterns over time, but need a lot of data and compute.

Mature deployments use adaptive baselining, where the model accounts for the rhythm of the day, week, and seasons on its own, along with micro-baselines — separate norms for a single segment, device, or identity. That way, small, local deviations show up instead of getting lost in one averaged-out norm.

Why does a baseline matter for security?

Signature-based detection only recognizes known attack patterns. A baseline combined with anomaly detection also makes it possible to spot unknown threats: zero-day attacks, bespoke tooling, and the abuse of legitimate accounts. The baseline is the foundation of NDR (Network Detection and Response) tools and an input for correlation in a SIEM. A well-tuned baseline also cuts down on alert fatigue. Because typical activity stays within the norm, it does not generate noise, and SOC analysts can focus on what genuinely stands out. There is one catch: if malicious activity was already present in the network while the model was learning, it can be absorbed into the norm by mistake. That is why the baselining period should rely on traffic checked beforehand as clean.

Common mistakes and good practices

• A baseline is not a one-time setup — it needs periodic review and updates as the network changes.
• A baseline alone does not guarantee security — it is one layer. It works best alongside access control, segmentation, and signature-based detection.
• Too short a learning period distorts the norm — capture full load cycles.
• Start with cautious thresholds and tighten them gradually as the model gets to know the environment.

Learn more

• SaaS Security Posture Management (SSPM) — Baselines help spot SaaS configuration drift and risky changes.
• Zero Trust architecture – the role of network visibility and microsegmentation in security — Baselines define normal traffic needed to verify Zero Trust policies.
• ARP spoofing – how to detect a Man-in-the-Middle attack and ARP poisoning in a LAN network — Baselines reveal abnormal ARP changes that may indicate spoofing.
• IDOR vulnerability – how to detect an attack on web applications through HTTP traffic analysis — Baselines help detect unusual HTTP access patterns linked to IDOR abuse.
• Network configuration errors – how to avoid them and improve router configuration — Baselines provide a reference for identifying configuration drift.
• What is NetFlow and how is this protocol used in practise? — NetFlow data is often used to build traffic baselines for anomaly detection.
• Golden Ticket attack – detecting Kerberos attacks and securing Active Directory — Baselines help spot abnormal Kerberos activity tied to Golden Tickets.