Establishing the normal, or expected, activity on a network or server is crucial to identifying when there is abnormal activity. There are a number of data points that can be used to objectively measure the activity on a network. These should be sampled over time to create a baseline of normal data.

We have learned that on a network, the key factors are throughput, session duration, ports (interfaces) used, and critical asset address space. On a server, the key factors are listening ports, logged in users/service accounts, running processes, running tasks, and applications.

Profiling a network or server is a continuous task. Normal differs based on a number of different factors, so knowledge of the operating conditions is vital to effective anomaly detection.