15. Network & Policy » Profiling Template

To add a new Profiling Template, go to Configuration » Network & Policy, click the [+] button from the title bar, and then select [Profiling Template]. Profiling Templates are mainly used to add identical profiling rules to multiple prefixes.

While a threshold rule (see Network & Policy » Threshold Template) triggers when traffic crosses a fixed value, a profiling rule triggers when traffic deviates from a baseline computed from the past traffic of the prefix. Profiling requires at least one Graph Storage Engine set to ClickHouse in General Settings » Graphs & Storage; the profiling data is stored on the first configured ClickHouse backend. Profiling rules can be defined for any decoder enabled in General Settings » Anomaly Detection.

Every profiling rule contains the following metrics:

● Domain – Sensors can detect anomalous deviations to/from an internal IP contained in the selected subnet, to/from the subnet taken as a whole, or to/from any included subnet with a longer prefix: from /20 to /30 for IPv4, and from /36 to /64 (in steps of 4) for IPv6

● Direction – The direction of traffic can be receives for the inbound traffic received by the prefix or sends for the outbound traffic sent by the prefix

● Decoder – Select one of the decoders enabled in General Settings » Anomaly Detection

● Unit – Select pkts/s for packet-rate deviations or bits/s for bandwidth deviations

● Deviation – Select above to detect traffic exceeding the baseline (e.g., DDoS attacks, flash crowds), or below to detect traffic dropping under the baseline (e.g., outages)

● × baseline – The per-rule sensitivity: the multiple of the baseline that the actual rate must reach to trigger an anomaly. For example, a value of 1.5 triggers when the traffic exceeds the expected baseline by 50%. Lower values make the rule more sensitive

● Min Floor – An absolute rate under which the rule never triggers, preventing false positives at hours when the baseline is very low. The value can be a multiple of 1,000 if K is appended, 1 million if M is appended, or 1 billion if G is appended. Leave the field empty for no floor

● Response – Select a previously defined Response, or select None to have no reaction to anomalies other than displaying them in Reports » Tools » Anomalies » Active Anomalies

● Parent – Select Yes if more specific prefixes should inherit the profiling rule

● Inheritance – Shown only when the rules are attached to a prefix of an IP Zone; displays the parent prefix when the rule is inherited from a less specific prefix

The order of the rules can be rearranged with drag and drop.

Baseline Profile selects, per template, the recipe used to compute the expected traffic baseline of every rule in the template. A baseline is a high percentile of the traffic rates observed during a trailing time window; periods when the prefix was under attack are always excluded from the computation, and baselines are recomputed periodically (daily, or hourly when a seasonal profile such as Business Hours is in use). Because the per-rule sensitivity is applied on top of the stored baseline, changing the × baseline value of a rule takes effect immediately, without waiting for a recompute. The built-in profiles are:

● Default – The 99th percentile of the traffic rates observed during the last 14 days. Requires at least 2,000 samples before rules start triggering

● Sensitive – The 95th percentile of the last 7 days; requires at least 1,000 samples. Reacts to weaker deviations, at the cost of more potential false positives

● Conservative – The 99.9th percentile of the last 30 days; requires at least 4,000 samples. Triggers only on strong deviations

● Business Hours – The 99th percentile of the last 28 days, computed separately for each hour of the day, with weekdays and weekends kept apart, so the expected traffic follows the daily and weekly pattern of the prefix (e.g., lower baselines during nights and weekends). Requires at least 60 samples in each of these 48 hourly slots

Custom baseline profiles can be defined in General Settings » Anomaly Detection, by clicking the Options button of the Profile Anomalies parameter.

Learning period. A profiling rule cannot trigger until its baseline profile has collected Min Samples traffic samples for the prefix. Sensors collect one sample per rule every IP Graph Granularity interval set in General Settings » Graphs & Storage (5 minutes by default, so 288 samples a day), starting when a Sensor monitors a prefix that has the rule. The baseline is used from the first recompute after enough samples exist. With the default settings, anomalies start being detected after:

Baseline Profile	Min Samples	Detection starts after
Sensitive	1,000	about 4 days
Default	2,000	about 7 days
Business Hours	60 per hourly slot	about 1 week for weekday hours; weekend hours from the third weekend
Conservative	4,000	about 14 days

Until then, the rules of the prefix stay silent, without any error or event. The learning period gets longer when samples are missing:

● Periods when the prefix is under attack are not counted

● Periods when the Sensor is stopped, or when ClickHouse is unreachable for more than a few minutes, are not counted

● A rule with the Internal IP domain collects a sample for an IP only when that IP has traffic, so IPs with intermittent traffic need more days than listed above. Subnet rules collect a sample every interval

A shorter IP Graph Granularity collects samples faster and shortens the learning period.

When defining a custom profile, choose a Min Samples value that the Window can actually hold; otherwise, the profile never produces a baseline and its rules never trigger. At the default granularity, a profile without seasonality collects 288 samples a day, so a 14-day window holds about 4,000. A seasonal profile counts samples separately in each slot, and a slot receives only 12 samples on each day it covers: an Hour of day slot gets 12 samples for every day of the Window, a Weekday × hour slot gets 12 for every weekday (or weekend day) of the Window, and an Hour of week slot gets only 12 per week. For example, a 28-day Weekday × hour window holds at most 240 samples per weekday slot and 96 per weekend slot. Windows longer than 30 days are shortened to 30 days, the retention of the baseline data.

When a profiling anomaly is detected, its graph in Reports » Tools » Anomalies » Active Anomalies displays the actual traffic, the expected baseline, and the trigger threshold (baseline × sensitivity).

Profiling rules can also be defined directly on the prefixes of an IP Zone, in the Profiling panel. Like Threshold Templates, Profiling Templates can be exported to a file and imported on another Console.

Note

Profiling rules work best on prefixes with a predictable traffic pattern. Larger subnets have a much more predictable traffic pattern than individual hosts, so prefer Subnet rules with a reasonable Min Floor to keep the number of false positives low.