5.4Network and server profiling

To know "what is abnormal," you must first know "what is normal." Profiling measures normal behavior as a baseline and surfaces anomalies from deviations. Whereas signature-based detection (known attack patterns) misses novel attacks, profiling can catch even unknown signs on the grounds of "different from usual." This section covers what is measured on the network side and the server side, and what a deviation indicates, as the judgment behind SOC anomaly detection.

5.4.1Elements of network profiling

• Total throughput—traffic volume per unit time. A sharp rise above baseline suggests data exfiltration or DDoS, a sharp drop suggests a service outage or blocking. Session duration—how long communications last; extremely long or regular sessions can indicate C2 beaconing.
• Ports used—the set of ports normally observed; unknown ports or abnormal port combinations not in the baseline hint at rogue services or tunneling. Critical asset address space—know the IP range of the servers you must protect and prioritize monitoring of abnormal traffic to/from it. Defining "what is critical" focuses detection.