A histogram is a column chart for frequency data. It groups numeric observations into continuous value ranges, with each vertical bar showing how often values fall in that range. It is useful when a time-series plot shows a wide range but does not make the distribution easy to interpret. section 6.1.5
For connection hunting, build a histogram of time_diff_sec—the time between consecutive connections—to inspect the distribution of connection intervals. Filter to a specific source, destination, port, and, when useful, application category before plotting; combining unlike traffic can hide meaningful patterns. section 6.1.5
Use a repeatable plotting workflow:
- Calculate time_diff_sec from consecutive connection timestamps within each source IP, destination IP, and destination-port group. section 6.1.5
- Filter the event data to the connection set under investigation, then sort it by epoch timestamp. section 6.1.5
- Select time_diff_sec and generate a histogram with a chosen bin count; the demonstrated plots use 50 bins. section 6.1.5
- Compare distributions for separate application values when a destination contains both identified and unknown traffic. section 6.1.5
Inspecting intervals to a destination
For connections from 10.0.0.4 to 208.80.154.224 over port 443, a line graph of time_diff_sec mainly shows a large value range. A histogram instead shows the distribution of those intervals. The same approach is then applied separately to HTTP and unknown connections from 10.0.0.4 to 34.125.188.180. section 6.1.5
Listing 6.26 Plot time_diff_sec for 10.0.0.4 and 208.80.154.224 over port 443
df.loc[(df['src_ip'] == '10.0.0.4') & (df['dest_ip'] \
== '208.80.154.224') & \(df['dest_port'] == 443)].\
sort_values(by=['epoch_timestamp'], ascending=True).\
set_index('epoch_timestamp')['time_diff_sec'].\
hist(figsize=[25,5], color='orange', bins=50) #1
This pandas expression filters one connection group, orders it by timestamp, selects time_diff_sec, and renders a 50-bin histogram. section 6.1.5
