The goal behind the long-term profile is to define normal traffic levels. The Sensor can identify anomalous spikes in traffic with reference to the defined normal levels. The Sensor also uses the gathered statistical data to calculate short-term profiles, that is statistical data averaged over a time window of a few minutes.
If a short-term profile, which includes DoS attack data, is used to update the long-term profile, it contaminates the long-term profile. Trellix IPS uses the following counter measures to help prevent contamination:
When in detection mode, the Sensor temporarily ceases updating the long-term profile if too many statistical anomalies are seen over a short period.
The Sensor uses percentile measure. A few large spikes in the short-term data will probably upset a simple average, but are less likely to affect a percentile measure. For example, imagine a group of four students taking an exam with percentile measure ranges of 0-29, 30-49, 50-69 and 70-100 for judging the effectiveness of the exam. Let us say three of the students receive grades of 95 percent, 93 percent, and 92 percent and the fourth receives a grade of 0 percent. The average score is only 70 percent but three of the four students are still in the 70-100 range. The teacher can therefore use the percentile ranges as a valid measure for judging the effectiveness of the exam.