Session duration - Learn Tech From Zero

5.7 Identify these elements used for network profiling

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

1. What is Session Duration?

Session duration refers to the total amount of time a communication session lasts between two devices on a network.

A session starts when a connection is established (for example, when a client connects to a server) and ends when the connection is terminated.

👉 In simple terms:
Session Duration = End Time − Start Time

2. Why Session Duration is Important in Network Profiling

In network profiling, session duration helps security analysts understand:

How long devices communicate
Whether the communication behavior is normal or abnormal
Patterns of user or system activity
Potential security threats or anomalies

It is a key metric used to build a baseline of normal network behavior.

3. How Session Duration is Measured

Session duration is calculated using timestamps:

Start Time: When the session begins (e.g., TCP handshake)
End Time: When the session ends (e.g., connection close or timeout)

The duration can be measured in:

Seconds
Minutes
Hours

4. Types of Sessions Based on Duration

a. Short Sessions

Last for a very brief time
Often involve quick requests and responses

IT Example:

A DNS query request and response
A web browser fetching a small file

b. Long Sessions

Remain active for an extended period
Often involve continuous data transfer or persistent connections

IT Example:

Remote administration sessions (SSH/RDP)
Video streaming or file transfer sessions

5. Session Duration in Different Protocols

a. TCP Sessions

Connection-oriented
Session duration is clearly defined (start to close)
Includes:
- SYN (start)
- FIN/RST (end)

b. UDP Sessions

Connectionless
No formal session start/end
Duration is estimated based on:
- Activity timeout
- Flow tracking by monitoring tools

6. Role of Session Duration in Security Analysis

Session duration helps identify normal vs abnormal behavior.

a. Normal Behavior

Consistent and predictable durations
Matches expected application usage patterns

b. Abnormal Behavior

Unusual session durations may indicate:

Very short sessions
- Could indicate:
  - Scanning activity
  - Failed connection attempts
  - Automated scripts
Very long sessions
- Could indicate:
  - Persistent unauthorized access
  - Data exfiltration
  - Backdoor communication

7. Use of Session Duration in Network Monitoring Tools

Security tools use session duration as part of flow data analysis, such as:

NetFlow
IPFIX
SIEM systems

These tools:

Track session start and end times
Store duration as a field
Allow filtering and analysis based on duration

8. Correlation with Other Network Profiling Elements

Session duration is more useful when combined with:

Total throughput (amount of data transferred)
Source and destination IP
Ports and protocols
Packet count

👉 Example (IT context):

A long session with very low data transfer may indicate idle or suspicious connections
A short session with high data transfer may indicate burst activity

9. Indicators of Compromise (IoCs) Related to Session Duration

Security analysts look for:

Unusually long-lived sessions
Frequent repeated short sessions
Sessions that do not match normal application behavior
Sessions active during unusual times

10. Limitations of Session Duration

Cannot alone confirm malicious activity
Some legitimate applications use:
- Very short sessions (e.g., APIs)
- Very long sessions (e.g., persistent services)
Requires correlation with other data for accurate analysis

11. Best Practices for Using Session Duration

Establish a baseline of normal session durations
Monitor for deviations from the baseline
Combine with other metrics for better detection
Use automated tools for tracking and alerts

12. Exam Tips (Important Points to Remember)

Session duration = time between session start and end
It is used for network profiling and anomaly detection
Helps identify:
- Normal vs abnormal communication patterns
Important in flow-based monitoring systems
Must be analyzed along with other network metrics

Summary

Session duration is a critical metric in network profiling that measures how long communication sessions last. It helps analysts understand behavior patterns, detect anomalies, and identify potential security threats. However, it should always be used together with other network data for accurate analysis.