What Is Network Traffic Analysis?

Network traffic analysis examines communication patterns to identify malicious activity. Because most traffic is now encrypted, the useful signal has moved from content to metadata — who talked to whom, when, how often, in what volume and for how long.

That turns out to be enough for a surprising amount, because the shape of a connection frequently reveals its purpose even when its contents are unreadable.

What metadata reveals

Regular connections at precise intervals to the same destination look like automated check-in, which is what command and control traffic is. Large sustained outbound transfers to an unfamiliar destination look like data exfiltration.

Internal systems suddenly connecting to peers they have never contacted before look like lateral movement. None of these require reading a single byte of payload.

It covers what endpoints cannot

Network visibility includes devices that cannot run an agent — industrial controllers, medical equipment, printers, cameras, appliances, anything embedded. In many estates that is a substantial share of connected devices and effectively all of the monitoring blind spot.

It also survives endpoint compromise. An attacker with administrative control of a host can interfere with its agent; they cannot easily hide the traffic that host puts on the wire.

Placement decides what you see

A sensor observes the traffic that crosses its vantage point. At the internet edge, that is inbound and outbound and nothing internal — which means east-west movement is invisible. Internal placement covers movement and costs more sensors.

Cloud workloads communicating with each other, and traffic between remote users and cloud services, may never traverse any monitored link at all. Establishing the observed share of traffic is worth doing explicitly.

Baselines and the cost of getting them wrong

Anomaly detection here depends on knowing what normal looks like, and normal in a real network includes backup windows, replication, patch distribution, monitoring polls and scheduled batch transfers — all of which resemble the patterns above.

A baseline established over too short a period, or during an atypical week, produces persistent false positives that erode confidence in the whole deployment.

Combining it with endpoint data

Traffic analysis tells you a connection happened; endpoint telemetry tells you which process made it. Either alone leaves a question the other answers, which is why correlating the two is the most productive pairing in detection.

Decryption, and whether it is worth it

Inspecting encrypted traffic requires terminating and re-encrypting it, which means the inspection point holds plaintext for every session it handles. That is a substantial new concentration of sensitive data and a performance cost, and certificate pinning means some traffic will break regardless.

The usual conclusion is selective: decrypt general web browsing, exclude banking, healthcare and personal categories for privacy and legal reasons, and accept metadata-only visibility elsewhere. Staff notice about inspection is a requirement in most jurisdictions and is the part most often overlooked.

Where to start

Establish what proportion of your traffic any sensor currently observes, including cloud and remote user traffic. The answer is usually lower than the architecture diagram suggests.

See DNS security. GuardsArm delivers managed security.