5.4Network and server profiling

To know "what is abnormal," you must first know "what is normal." Profiling measures normal behavior as a baseline and surfaces anomalies from deviations. Whereas signature-based detection (known attack patterns) misses novel attacks, profiling can catch even unknown signs on the grounds of "different from usual." This section covers what is measured on the network side and the server side, and what a deviation indicates, as the judgment behind SOC anomaly detection.

5.4.1Elements of network profiling

• Total throughput—traffic volume per unit time. A sharp rise above baseline suggests data exfiltration or DDoS, a sharp drop suggests a service outage or blocking. Session duration—how long communications last; extremely long or regular sessions can indicate C2 beaconing.
• Ports used—the set of ports normally observed; unknown ports or abnormal port combinations not in the baseline hint at rogue services or tunneling. Critical asset address space—know the IP range of the servers you must protect and prioritize monitoring of abnormal traffic to/from it. Defining "what is critical" focuses detection.

5.4.2Elements of server profiling

• Listening ports—the set of ports the server is listening on (LISTEN state); a new listening port not in the baseline is a strong sign of a backdoor or rogue service. Logged-in users / service accounts—who is currently logged on and which service accounts are running; unexpected accounts, admin logins at odd hours, or activity by normally idle service accounts warrant attention.
• Running processes / tasks—running processes and scheduled tasks; suspicious process names/parentage not in the baseline, or unfamiliar recurring tasks (a persistence technique), are signs of compromise. Applications—the installed/running software set; unapproved apps or altered binaries indicate malware or policy violations.

On a weekday morning, on the SOC dashboard you notice that the total throughput from an internal accounting server to the outside has spiked to dozens of times its usual level. The signature-based IDS is silent—because the attacker used no known malware and quietly siphoned data with legitimate tools. This is where profiling helps. You first compare against the network profiling baseline. This accounting server normally only exchanges short sessions with an internal DB during business hours; a large external upload is implausible—a clear baseline deviation. Moreover, the destination is an unfamiliar overseas IP outside the critical asset address space, and the port used is a high port other than the baseline 443. Next, checking the target's server profiling, you find a new listening port absent from the peacetime baseline, and a service account created in the small hours running an unfamiliar process and a scheduled task (persistence). Even if each indicator alone is inconclusive, the coincidence of network-side deviations (large outbound, unknown port, unknown destination) and server-side deviations (new listening port, suspicious account, persistence task) lets you judge with high confidence that this is a compromise involving exfiltration. The lesson: even when signatures are silent, holding the view of "deviation from a normal baseline" catches unknown attacks, and overlaying network and server profiles turns individually ambiguous signs into certainty. This is exactly why taking an accurate baseline in peacetime is the SOC's detective power itself.

5.4.3Section summary

• Profiling measures a normal-state baseline and detects anomalies via deviation from it, complementing signature detection's blind spots for unknown attacks
• The network profiling elements = total throughput, session duration, ports used, critical asset address space
• The server profiling elements = listening ports, logged-in users/service accounts, running processes/tasks, applications; coinciding deviations on both sides raise confidence