15. Network & Policy » Profiling Template
While a threshold rule (see Network & Policy » Threshold Template) triggers when traffic crosses a fixed value, a profiling rule triggers when traffic deviates from a baseline computed from the past traffic of the prefix. Profiling requires at least one Graph Storage Engine set to ClickHouse in General Settings » Graphs & Storage; the profiling data is stored on the first configured ClickHouse backend. Profiling rules can be defined for any decoder enabled in General Settings » Anomaly Detection.
Every profiling rule contains the following metrics:
● Domain – Sensors can detect anomalous deviations to/from an internal IP contained in the selected subnet, to/from the subnet taken as a whole, or to/from any included subnet with a longer prefix: from /20 to /30 for IPv4, and from /36 to /64 (in steps of 4) for IPv6● Direction – The direction of traffic can be receives for the inbound traffic received by the prefix or sends for the outbound traffic sent by the prefix● Decoder – Select one of the decoders enabled in General Settings » Anomaly Detection● Unit – Select pkts/s for packet-rate deviations or bits/s for bandwidth deviations● Deviation – Select above to detect traffic exceeding the baseline (e.g., DDoS attacks, flash crowds), or below to detect traffic dropping under the baseline (e.g., outages)● × baseline – The per-rule sensitivity: how many times the baseline the actual rate must reach to trigger an anomaly. For example, a value of 1.5 triggers when the traffic exceeds the expected baseline by 50%. Lower values make the rule more sensitive● Min Floor – An absolute rate under which the rule never triggers, preventing false positives at hours when the baseline is very low. The value can be a multiple of 1,000 if “K” is appended, 1 million if “M” is appended, or 1 billion if “G” is appended. Leave the field empty for no floor● Response – Select a previously defined Response, or select None to have no reaction to anomalies other than displaying them in Reports » Tools » Anomalies » Active Anomalies● Parent – Select Yes if more specific prefixes should inherit the profiling rule● Inheritance – Shown only when the rules are attached to a prefix of an IP Zone; displays the parent prefix when the rule is inherited from a less specific prefix
The order of the rules can be rearranged with drag and drop.
Baseline Profile selects, per template, the recipe used to compute the expected traffic baseline of every rule in the template. A baseline is a high percentile of the traffic rates observed during a trailing time window; periods when the prefix was under attack are always excluded from the computation, and baselines are recomputed periodically (daily, by default). Because the per-rule sensitivity is applied on top of the stored baseline, changing the × baseline value of a rule takes effect immediately, without waiting for a recompute. The built-in profiles are:
● Default – The 99th percentile of the traffic rates observed during the last 14 days. Requires at least 2,000 samples before rules start triggering● Sensitive – The 95th percentile of the last 7 days; requires at least 1,000 samples. Reacts to weaker deviations, at the cost of more potential false positives● Conservative – The 99.9th percentile of the last 30 days; requires at least 4,000 samples. Triggers only on strong deviations● Business Hours – The 99th percentile of the last 28 days, computed separately for each hour of each weekday, so the expected traffic follows the weekly pattern of the prefix (e.g., lower baselines during nights and weekends). Requires at least 300 samples per hour-of-week bucket
Custom baseline profiles can be defined in General Settings » Anomaly Detection, by clicking the Options button of the Profile Anomalies parameter.
When a profiling anomaly is detected, its graph in Reports » Tools » Anomalies » Active Anomalies displays the actual traffic, the expected baseline, and the trigger threshold (baseline × sensitivity).
Profiling rules can also be defined directly on the prefixes of an IP Zone, in the Profiling panel. Like Threshold Templates, Profiling Templates can be exported to a file and imported on another Console.
Note
Profiling rules work best on prefixes with a predictable traffic pattern. Larger subnets have a much more predictable traffic pattern than individual hosts, so prefer Subnet rules with a reasonable Min Floor to keep the number of false positives low.