Flow based analysis
Flow-based analysis is the process of analyzing network traffic as compact, structured metadata records ("flows") instead of full packet captures. Each flow is identified by a "5-tuple" identity (source/destination IP, source/destination port, and protocol) and described by attributes such as volume, duration, and timing. This provides long-term behavioral visibility without inspecting payload contents.