Normal and anomalous traffic flow pattern analysis for organizational networks

Traffic monitoring and analysis has become necessary to understand the nature of information flowing within an organization. This is particularly important due to the recent trend of increase in the percentage of anomalous traffic in the overall organizational traffic composition. In this work, we attempt to determine the typical characteristics seen in various organizational network traffic. We use simple flow analysis methods on different datasets which include normal and anomalous traffic. Results from such an analysis can play a vital role in problems ranging from feature selection for machine learning based models to help tune the rules of an intrusion detection system (IDS). Based on the analysis of number of flows, packet size, number of packets per flow, flow duration, and protocol composition present in each dataset, we present our findings in this work.