Dynamic Baselines
Automatic threshold learning that adapts to your traffic patterns
How It Works
Flowtriq uses a 300-sample sliding window with p99 percentile calculation to learn what "normal" looks like for each node. Instead of setting a fixed PPS threshold, the system continuously computes what traffic should look like based on recent history.
Sliding-Window p99
- Window size: 300 samples (one sample per second, covering ~5 minutes of traffic)
- Recalculation interval: Every 10 ticks (~10 seconds)
- Detection threshold: 3x the p99 PPS (configurable per node)
An anomaly is flagged when current traffic exceeds 3x the p99 value from the sliding window. Because the window continuously slides forward, the baseline naturally adapts to gradual legitimate traffic increases. A sudden attack will exceed the p99 threshold while normal growth shifts the window upward over time.
Convergence
- 5 minutes: The 300-sample window is fully populated and the p99 baseline reflects the node's actual traffic pattern
- Bootstrap phase: During the first 5 minutes after agent startup, detection falls back to conservative static thresholds based on the interface line rate
What Gets Baselined
The detection engine computes independent baselines for:
- Packets per second (PPS) for volumetric floods
- Bytes per second (BPS) for amplification attacks with large packets
- New connections per second derived from SYN rates
- Protocol ratio (TCP/UDP/ICMP) to catch protocol-shift attacks
An alert fires when any single metric crosses its threshold.
Configuration
Baselines are configured per-node from Dashboard → Nodes → [Node] or workspace-wide from Dashboard → Scrubbing → Advanced.
| Setting | Description | Default |
|---|---|---|
| Mode | Static (fixed threshold) or Dynamic (auto-learning) | Dynamic |
| Fast multiplier | How many times above the fast baseline to trigger | 3x |
| Slow multiplier | How many times above the slow baseline to trigger | 5x |
| Learning window | Hours of history used for baseline computation (24-720) | 168 (7 days) |
| Static threshold | Fixed PPS threshold (only used in Static mode) | Based on interface line rate |
Per-Host Threshold Overrides
For critical infrastructure that needs tighter or looser thresholds, configure per-IP overrides from Dashboard → Scrubbing → Per-Host. Each override lets you set custom escalation thresholds at every level (local, FlowSpec, RTBH, scrubbing) and optionally enable geo lockdown for that IP.
Handling Scheduled Events
- Maintenance windows: Schedule windows during which alerting is suppressed. Baselines continue learning so they adapt to the new traffic level.
- Sensitivity profiles: Game servers with known spiky traffic can use a 5x fast multiplier instead of 3x. Database servers with predictable traffic can use 2x for earlier detection.