Skill Market

implementing network traffic baselining

Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score

GitHub
githubcommunityai-agentsclaude-codecloud-securitycybersecuritydevsecopsethical-hacking
0.0
0 installs33.4K GitHub starsby mukul975

Skill Introduction

Overview
Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score

Core value

Turns reusable Development know-how into an installable skill, helping users complete github, community, ai-agents, claude-code work faster.

Target users

  • Developers, testers, and maintainers who handle Development tasks in Focus Code.
  • Teams that already trust workflows or content from mukul975.
  • Users who want standardized prompts, steps, or conventions instead of repeating setup work.

Best practices

  • Read the skill content first to confirm required inputs, expected outputs, and dependencies.
  • Try it on a small task before relying on it for critical work.
  • Add project-specific constraints such as coding style, target platform, test expectations, and delivery format.
  • For external sources, verify the source link, version, and recent maintenance activity.

Best use cases

  • Tasks related to github, community, ai-agents, claude-code that need a reusable execution flow.
  • Converting a community repo, team convention, or personal workflow into day-to-day assistance.
  • Starting from a proven skill instead of writing prompts or procedures from scratch.

Limits and boundaries

  • Results depend on the quality of the original skill content and may need human correction.
  • It does not replace code review, tests, security review, or professional judgment.
  • External tools, APIs, account permissions, and local dependencies still need separate setup.

Differentiation

  • Structured around Development, making it easier to discover and reuse than loose prompt snippets.
  • Marked as GitHub, which helps users judge trust and maintenance expectations.
  • Keeps the original source link available for repository, documentation, or discussion follow-up.
  • Tagged with github, community, ai-agents, claude-code, so it can be filtered by concrete task intent.

Install and use

Install
Copy Install Command
focus install implementing-network-traffic-baselining-e481f7
View source

Detail Preview

SKILL.md

Primary filemarkdown3 KB

name: implementing-network-traffic-baselining description: Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic pattern profiling domain: cybersecurity subdomain: network-security tags:

  • netflow
  • ipfix
  • traffic-analysis
  • baselining
  • anomaly-detection
  • pandas
  • network-monitoring version: '1.0' author: mahipal license: Apache-2.0 nist_csf:
  • PR.IR-01
  • DE.CM-01
  • ID.AM-03
  • PR.DS-02

Implementing Network Traffic Baselining

Overview

Network traffic baselining establishes normal communication patterns by analyzing historical NetFlow/IPFIX data to create statistical profiles of expected behavior. This skill uses Python pandas to compute hourly and daily traffic distributions, per-host byte/packet counts, protocol ratios, and top-N talker profiles. Anomalies are detected using z-score thresholds and IQR (interquartile range) outlier methods, enabling SOC analysts to identify deviations such as data exfiltration spikes, beaconing patterns, and unusual port usage.

When to Use

  • When deploying or configuring implementing network traffic baselining capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • NetFlow v5/v9 or IPFIX flow data exported as CSV or JSON
  • Python 3.8+ with pandas and numpy libraries
  • Historical flow data (minimum 7 days recommended for baseline)

Steps

  1. Ingest NetFlow/IPFIX records from CSV or JSON exports
  2. Compute hourly and daily traffic volume distributions (bytes, packets, flows)
  3. Build per-source-IP baseline profiles with mean, median, standard deviation
  4. Calculate protocol and port distribution baselines
  5. Apply z-score anomaly detection to identify statistical outliers
  6. Flag flows exceeding IQR-based thresholds as potential anomalies
  7. Generate baseline report with anomaly alerts

Expected Output

JSON report containing traffic baselines (hourly/daily profiles), per-host statistics, detected anomalies with z-scores, and top talker rankings with deviation indicators.

Reviews

Overall rating

0.0
0.0

0 comments

No reviews yet