Why is correlating traffic patterns with baselines important in detecting anomalies?

• A. It helps distinguish legitimate variations from suspicious activity
• B. It makes analysis slower
• C. It increases false positives
• D. It is unnecessary

Answer: (A)

Comparing current traffic to established baselines lets you distinguish normal variation from suspicious activity. A baseline represents typical traffic patterns—volume, timing, sources, destinations, and protocols—under normal conditions. When you monitor in real time, you look for deviations from that baseline. If spikes occur during expected periods (like business hours or during a scheduled backup), they may be legitimate; if they occur at unusual times or in unexpected patterns, they can indicate a problem. Baselines also adapt over time, so the detection system avoids overreacting to ordinary changes. This approach reduces false positives by ensuring alerts reflect meaningful deviations rather than every blip in traffic. It’s not slower or unnecessary; it provides essential context that makes anomaly detection more accurate and actionable.