implementing-network-traffic-baselining

Ingest NetFlow v5/v9 or IPFIX records from CSV or JSON exports into pandas, then compute hourly and daily distributions of bytes, packets, and flows. Build per-source-IP profiles with mean, median, and standard deviation, and apply z-score or IQR thresholds to flag outliers.

Use pandas and numpy to compute per-host and per-time-window statistics, then flag flows whose values exceed a z-score threshold or fall outside the IQR-based outlier range. Baseline per hour-of-day and day-of-week rather than globally to avoid false positives on diurnal peaks.

A minimum of 7 days of historical flow data is recommended so the baseline covers full weekly cycles. Shorter windows, or windows containing an active incident, bake anomalies into the definition of normal and degrade detection accuracy.

Network volume is heavy-tailed and diurnal, so a single global mean and standard deviation flags every business-hours peak. Baseline per hour-of-day and day-of-week, and prefer IQR or MAD methods for skewed distributions instead of one global z-score.

Yes. Sampled exports such as 1:1000 skew byte and packet volumes, and active-timeout flow splitting makes one long transfer appear as many small flows. Normalize for the sampling rate and account for flowDuration before summing bytes and packets.