Detecting Anomalies in Network Traffic

The most sophisticated attackers don't generate signature-match alerts. They blend into normal traffic — but perfectly blending into noise is impossible. Every action leaves a pattern.

Signature-based tools answer one question: have we seen this exact thing before? Anomaly detection asks a different one: is this normal for this network? That shift matters because custom malware, living-off-the-land techniques and a stolen set of valid credentials all sail past signatures. What they can't avoid is behaving differently from the users and machines they impersonate.

Everything starts with a baseline — a working picture of what normal looks like. Built from the NetFlow and packet data covered in the previous lessons, a useful baseline answers practical questions: which hosts talk to which, on what ports, at what times of day, and in what volumes. A file server that pushes gigabytes to the backup appliance every night is normal. The same file server pushing gigabytes to an unfamiliar cloud storage provider at 3 AM is not. Baselines have to be kept current, too: a new SaaS rollout, an office move or a merger changes what normal means, and a stale baseline either floods analysts with false positives or quietly absorbs the attacker into the noise.

With a baseline in place, a handful of patterns account for most of what analysts chase on the wire:

• Beaconing. Compromised hosts check in with command-and-control servers on a schedule. Look for connections to the same external destination at regular intervals, with small, consistent payload sizes. Many malware families add random jitter to the timer, so analysts look at the distribution of intervals rather than demanding a perfect clock.
• Unusual outbound ports and protocols. A workstation speaking SSH, SMB or a raw high-numbered port to the internet, or DNS traffic that bypasses the internal resolver entirely, deserves a closer look.
• Internal scanning and lateral movement. One host touching dozens of internal peers on 445, 3389 or 22 in a short window is usually either an approved vulnerability scanner or an attacker mapping the network. Knowing which scanners are sanctioned is part of the baseline.
• Volume and direction changes. Most endpoints download far more than they upload. A sustained reversal — large, steady outbound transfers — is a common signature of data staging and exfiltration.
• Rare destinations. A domain or IP address that nothing else in the environment has ever contacted, especially one registered only recently, is worth enriching with threat intelligence before it's dismissed.

No single anomaly proves compromise. Traffic that looks alarming at 3 AM on a Sunday may be a scheduled backup; the same pattern at 2 PM from the finance team's laptop may be the real problem. Analysts ask who owns the host, what it normally does, whether a change ticket explains the behavior, and whether any other layer saw something at the same time. An odd outbound connection is weak evidence on its own. The same connection from a host where the endpoint agent also logged a suspicious PowerShell launch is a lead worth escalating.

That correlation is the core of the work. Network anomalies tell you something changed; endpoint, identity and cloud telemetry tell you what and who. Tuning matters as much as detection: every confirmed benign pattern should feed back into the baseline, so tomorrow's alert queue is shorter and sharper than today's.

Vijilan's SOC analysts work this way around the clock, correlating network anomalies with endpoint and identity signals whether they're monitoring a client's existing EDR under ThreatRespond™ or running the fully managed CrowdStrike Falcon stack under ThreatDefend™ — for MSP and MSSP partners, VARs and distributors, and mid-market and enterprise organizations that come to Vijilan directly.