All DDoS Definitions
DDoS Testing Definition

Baseline Traffic

Baseline traffic measures what normal looks like for a service before anyone attacks it. Under attack the baseline does not move, which is the point: every other number a DDoS test reports, from lost users to recovery time, is expressed as a distance from it. It is the measured shape of a service's legitimate load over time: request rates, bandwidth, connection counts, geographic distribution, protocol mix, and their daily and weekly cycles. Anomaly-based mitigation compares live traffic against this baseline to decide what is abnormal, so the quality of the baseline directly governs how accurately an attack is distinguished from a sales spike or a product launch.

Baseline traffic: the normal shape mitigation measures against baseline envelope (normal cycle) legitimate surge, inside envelope attack, outside envelope flagged abnormal Mon Wed Fri Sun time legit load rides the daily and weekly cycle A defense that does not know normal cannot reliably recognize abnormal. A test establishes the baseline first, then layers a controlled attack on top, measuring how cleanly the mitigation separates the two under realistic mixed load. BlackNeuron™
Diagram of baseline traffic: a legitimate sales surge staying inside the normal daily and weekly envelope while an attack spike breaks far above it and is flagged abnormal

What goes into a usable baseline

The first requirement is length. A baseline captured over one day mistakes that day for normal, so Monday's login rush looks like an anomaly on Sunday and Sunday's lull hides a slow climb. A full weekly cycle is the minimum, and several weeks are better, because the second week shows how much normal itself varies.

The second is percentiles rather than averages. An hourly average smooths away exactly the peaks a defence must tolerate. Recording the median and the 95th or 99th percentile for each hour of the week gives an envelope rather than a line, and the envelope is what a threshold should sit above.

The third is granularity. A single requests-per-second figure for a whole site hides the fact that the login endpoint, the search API and the static assets have entirely different normals. So do traffic by country, by source network, and the share of new versus returning clients. A flood aimed at one expensive endpoint can be invisible in the site-wide total and obvious in that endpoint's own baseline.

Finally, a baseline has a date. A release that adds a chatty client, a move to a new CDN, or a marketing calendar with a launch next week all change normal. Adaptive protections that learn their own baseline face the same problem from the other side: right after onboarding, or right after a large migration, the learned model is thin and its thresholds are guesses.

How a test uses it

A test uses the baseline three ways, and each is a measurement rather than a formality.

It sets the pass mark. "The service survived" means nothing until it is written as a fraction of baseline, for example legitimate requests still succeeding at 95% of their normal rate for that hour of the week. That fraction is goodput read against normal, and it is the headline number of most test reports.

It sizes the attack. Steps in a ramp are expressed as multiples of the baseline peak, so the result says something portable: the defence held at four times normal and failed at six, rather than at an absolute figure that means nothing to the next reader.

It supplies the legitimate traffic. The background load running alongside the attack should reproduce the baseline mix of endpoints, regions and client types. Otherwise the false-positive rate is measured against users who do not exist, and a filter that would block real customers looks clean.

Baseline traffic: the fixed line every result is read against baseline: p95 for this hour, two weeks of capture success rate vs normal test run, same hour of the week as the capture captured before the run gap to baseline = damage filters engage back inside the envelope The baseline never moves during the test; the report is the distance from it, as a fraction of normal BlackNeuron™
Animated baseline traffic: the dashed baseline for this hour of the week stays fixed while the measured success rate drops below it under attack and climbs back, so the gap between the two is the damage the test reports

One caution applies to tests that repeat. A protection that keeps learning from live traffic may fold test traffic into its idea of normal. Repeated runs against the same adaptive policy should check whether its thresholds drifted upward between them, because a test that trains the defence to accept it has stopped measuring anything.

Why this separation of normal from hostile sits at the centre of resilience work, and what else a resilience programme measures against it, is set out in DDoS resilience testing.