Dynamic Baselines
Automatic threshold learning that adapts to your traffic patterns
How It Works
Flowtriq uses exponentially weighted moving averages (EWMA) with two windows to learn what "normal" looks like for each node. Instead of setting a fixed PPS threshold, the system continuously computes what traffic should look like based on recent history.
Dual-Window EWMA
- Fast window (alpha = 0.3): Reacts within minutes. Catches sudden deviations from the current traffic pattern.
- Slow window (alpha = 0.05): Takes hours to shift. Provides a stable reference for the longer-term norm.
An anomaly is flagged when current traffic exceeds the fast baseline by a configurable multiplier (default 3x) and the slow baseline by a separate multiplier (default 5x). This means a gradual legitimate traffic increase shifts the fast baseline upward and avoids false alerts, while a sudden attack exceeds both simultaneously.
Convergence
- 5 minutes: Fast baseline is within 15% of the true traffic mean
- 30 minutes: Slow baseline has converged sufficiently for robust detection
- Bootstrap phase: During the first 5 minutes after agent startup, detection falls back to conservative static thresholds based on the interface line rate
What Gets Baselined
The detection engine computes independent baselines for:
- Packets per second (PPS) for volumetric floods
- Bytes per second (BPS) for amplification attacks with large packets
- New connections per second derived from SYN rates
- Protocol ratio (TCP/UDP/ICMP) to catch protocol-shift attacks
An alert fires when any single metric crosses its threshold.
Configuration
Baselines are configured per-node from Dashboard → Nodes → [Node] or workspace-wide from Dashboard → Scrubbing → Advanced.
| Setting | Description | Default |
|---|---|---|
| Mode | Static (fixed threshold) or Dynamic (auto-learning) | Dynamic |
| Fast multiplier | How many times above the fast baseline to trigger | 3x |
| Slow multiplier | How many times above the slow baseline to trigger | 5x |
| Learning window | Hours of history used for baseline computation (24-720) | 168 (7 days) |
| Static threshold | Fixed PPS threshold (only used in Static mode) | Based on interface line rate |
Per-Host Threshold Overrides
For critical infrastructure that needs tighter or looser thresholds, configure per-IP overrides from Dashboard → Scrubbing → Per-Host. Each override lets you set custom escalation thresholds at every level (local, FlowSpec, RTBH, scrubbing) and optionally enable geo lockdown for that IP.
Handling Scheduled Events
- Maintenance windows: Schedule windows during which alerting is suppressed. Baselines continue learning so they adapt to the new traffic level.
- Sensitivity profiles: Game servers with known spiky traffic can use a 5x fast multiplier instead of 3x. Database servers with predictable traffic can use 2x for earlier detection.