mcpField
I
implementing-network-traffic-baselining

implementing-network-traffic-baselining

github.com/mukul975Security35.2k48 installsUpdated 8w ago
Repository

About implementing-network-traffic-baselining

A skill for security teams to profile historical NetFlow/IPFIX traffic and identify deviations from expected communication patterns using statistical baselines and outlier detection.

Key features

  1. 01Compute hourly and daily traffic distributions
  2. 02Build per-host statistical profiles
  3. 03Analyze protocol and port distributions
  4. 04Detect outliers with z-scores and IQR
  5. 05Generate JSON reports with anomaly alerts

Use cases

  1. 01Spot spikes that may indicate data exfiltration
  2. 02Identify beaconing patterns
  3. 03Investigate unusual port usage
  4. 04Establish a network traffic security baseline

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill implementing-network-traffic-baselining

After installing, type/implementing-network-traffic-baseliningin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Implementing Network Traffic Baselining

Overview

Network traffic baselining establishes normal communication patterns by analyzing historical NetFlow/IPFIX data to create statistical profiles of expected behavior. This skill uses Python pandas to compute hourly and daily traffic distributions, per-host byte/packet counts, protocol ratios, and top-N talker profiles. Anomalies are detected using z-score thresholds and IQR (interquartile range) outlier methods, enabling SOC analysts to identify deviations such as data exfiltration spikes, beaconing patterns, and unusual port usage.

When to Use

  • When deploying or configuring implementing network traffic baselining capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • NetFlow v5/v9 or IPFIX flow data exported as CSV or JSON
  • Python 3.8+ with pandas and numpy libraries
  • Historical flow data (minimum 7 days recommended for baseline)

Steps

  1. Ingest NetFlow/IPFIX records from CSV or JSON exports
  2. Compute hourly and daily traffic volume distributions (bytes, packets, flows)
  3. Build per-source-IP baseline profiles with mean, median, standard deviation
  4. Calculate protocol and port distribution baselines
  5. Apply z-score anomaly detection to identify statistical outliers
  6. Flag flows exceeding IQR-based thresholds as potential anomalies
  7. Generate baseline report with anomaly alerts

Expected Output

JSON report containing traffic baselines (hourly/daily profiles), per-host statistics, detected anomalies with z-scores, and top talker rankings with deviation indicators.

Comments

Markdown supported