Finding Hidden Dwell Time Through Network Traffic Analysis

A successful intrusion rarely announces itself with a single dramatic event. Attackers may obtain valid credentials, establish a quiet foothold, test internal routes and wait weeks before collecting valuable data. This interval between initial compromise and discovery is known as dwell time, and it is often where the greatest damage accumulates.

Network traffic analysis helps security teams uncover that hidden period by examining how systems communicate rather than relying only on endpoint alerts or known malware signatures. DNS requests, authentication flows, encrypted sessions, east-west movement and unusual data transfers can reveal behaviour that appears harmless when viewed in isolation.

For Australian organisations, the issue is especially relevant as hybrid work, cloud adoption and outsourced services expand the attack surface. A business in Sydney may have users, workloads and suppliers operating across Melbourne, Perth, Singapore and public cloud regions. Traffic visibility must therefore extend beyond the traditional office perimeter.

CARM Security reflects this broader requirement by bringing together technologies that support identification, containment, response and remediation. When network evidence is connected with endpoint, identity and threat intelligence data, incident responders can reconstruct an attacker’s timeline instead of treating each alert as an unrelated event.

Why Dwell Time Hides In Plain Sight

Attackers often behave like legitimate users after gaining access. They may use PowerShell, remote administration tools, cloud consoles or ordinary file-sharing protocols already approved by the organisation. A connection to a domain controller, database or SaaS platform may therefore look routine unless its timing, volume and context are examined.

The difficulty increases when security monitoring focuses on perimeter traffic. Modern intrusions frequently move laterally between internal servers, containers, virtual machines and identity systems. This east-west traffic can remain invisible to controls designed mainly to inspect north-south flows between the corporate network and the internet.

Encryption adds another layer of complexity. Security teams may not be able to inspect the contents of every session, particularly where privacy, performance or regulatory considerations apply. Traffic metadata still provides useful signals: who connected, when, for how long, to which service, using what protocol and with what change in volume or frequency.

Dwell time also hides in normal business rhythms. A finance system may transfer files every Friday, while a logistics platform sends data overnight. An attacker who imitates those patterns can avoid simplistic thresholds. Effective analysis must establish a baseline for each environment and then identify deviations that combine several weak signals.

Building A Useful Traffic Baseline

A reliable baseline begins with asset and identity context. The monitoring system should know whether an address belongs to a domain controller in Canberra, a point-of-sale server in Adelaide, a developer workstation in Melbourne or an unmanaged device connecting through a home router. Raw IP addresses rarely provide enough meaning for rapid investigation.

Useful telemetry includes DNS activity, NetFlow or equivalent flow records, proxy logs, firewall events, VPN connections, cloud network logs and authentication records. Packet capture can be valuable for selected segments, yet full capture is not always practical across a large distributed environment. The objective is enough detail to identify relationships and changes over time.

Baseline models should account for Australian operating patterns. A connection from Brisbane to a Singapore-hosted service may be normal for a regional business, while the same connection from a warehouse terminal at 3 am could deserve review. Public holidays, end-of-month processing and daylight-saving differences between states can also affect apparent anomalies.

Teams should record normal service dependencies instead of suppressing alerts broadly. If a payroll application communicates with a defined database cluster, that relationship can be documented and monitored. A later connection from the same application to an unfamiliar external host should remain visible, even when the application itself is trusted.

Signals That Reveal Lateral Movement

Lateral movement often produces a sequence of small changes rather than one decisive indicator. An employee laptop may authenticate to a file server, then query several hosts over SMB, RDP or Windows Remote Management. Each action might be permitted, but the sequence can show reconnaissance followed by privilege expansion.

Authentication patterns are particularly valuable when combined with flow data. A service account suddenly used from a new subnet, a dormant administrator account contacting multiple servers or a workstation initiating connections normally associated with infrastructure administration may indicate credential theft. Kerberos ticket activity, LDAP queries and repeated failed logins add useful context.

Other indicators include unusual DNS lookups, newly observed internal destinations, beacon-like connections at regular intervals and data movement that does not match the host’s role. A web server communicating directly with a user workstation may be more significant than a single connection to a known cloud provider. Detection improves when relationships are visualised as a changing graph.

Network traffic analysis can also expose command-and-control activity without decrypting every payload. Repeated outbound sessions with consistent timing, uncommon destination infrastructure, low-volume transfers and protocol misuse may point to a compromised host. Analysts should correlate these findings with endpoint process data before assigning severity.

Organisations also need to consider information leaving through legitimate channels. Monitoring the interaction between email, identity and network controls can strengthen protection against accidental and malicious disclosure; practical guidance on email monitoring controls is relevant when investigating how sensitive files move beyond approved systems.

Turning Detection Into Incident Reconstruction

Finding a suspicious flow is only the beginning. Responders need to determine when the attacker first gained access, which identities were used, what systems were touched and whether data was staged or removed. A common timeline should combine traffic events with endpoint alerts, email telemetry, identity logs, vulnerability information and user activity.

The investigation should preserve evidence before containment changes the environment. Exporting relevant flow records, DNS logs, firewall events and cloud audit trails helps maintain a defensible record. Time synchronisation matters: a five-minute discrepancy between a firewall, identity provider and endpoint can make an intrusion appear to happen in the wrong order.

CARM’s coordinated approach is useful in this phase because remediation rarely belongs to one product category. An endpoint may need isolation, a credential may require disabling, a firewall rule may need tightening and a vulnerable application may require patching. Linking these actions to the same incident reduces fragmented decision-making across internal teams and security providers.

Containment should be proportionate to business impact. Isolating a clinical, manufacturing or transport system without considering operational dependencies may create a serious outage. In Australia, organisations with distributed branches and critical services may need to coordinate across local IT teams, managed service providers and incident response specialists while preserving essential operations.

Measuring Detection And Response Quality

Dwell time is often discussed as a single number, but it contains several measurable stages. Time to initial detection indicates how quickly suspicious activity becomes visible. Time to triage measures how rapidly analysts establish whether an alert matters. Time to contain shows how effectively the organisation limits further movement.

Coverage metrics add essential context. Teams can measure the proportion of critical assets sending usable telemetry, the percentage of privileged activity mapped to a known identity and the number of internal segments covered by flow monitoring. A low dwell-time figure based on incomplete visibility may create false confidence.

Detection logic should be tested through controlled exercises and retrospective hunts. Analysts can search for unusual administrative protocols, rare internal connections, new external destinations and data transfers that occurred before a known alert. Lessons from these reviews should improve data collection, playbooks and escalation paths rather than simply create more rules.

Australian organisations should align monitoring with their risk and reporting obligations, including the Notifiable Data Breaches scheme where applicable and sector-specific expectations. The Australian Signals Directorate’s Essential Eight can support foundational resilience, but network analysis adds a behavioural layer that helps identify compromise after preventive controls have been bypassed.

Choosing An Operating Model For Visibility

Technology selection should follow the questions the response team needs to answer. A flow-monitoring platform may provide broad coverage with limited content visibility, while network detection and response tools can apply richer behavioural analytics. Packet capture delivers deeper investigation potential but demands more storage, tuning and specialist capability.

A mature operating model combines automation with human judgement. Automated systems can flag unusual peer groups, identify beaconing, enrich destinations with threat intelligence and trigger containment workflows. Analysts still need to understand business context, validate false positives and decide whether an action could disrupt essential services.

The comparison below shows how common monitoring approaches contribute to hidden dwell-time discovery:

Approach	Best visibility	Main strength	Common limitation
Firewall and proxy logs	Internet and policy-controlled traffic	Shows permitted and blocked connections	May miss internal movement
NetFlow or flow records	Communication patterns and volumes	Broad, efficient coverage	Limited content and process context
DNS monitoring	Requested domains and resolution behaviour	Exposes unusual lookups and threat infrastructure	Can be bypassed or obscured
Endpoint telemetry	Processes, files and local actions	Links network activity to host behaviour	Coverage gaps on unmanaged devices
Network detection and response	Correlated behavioural signals	Identifies patterns across users, hosts and destinations	Requires tuning and skilled review
Full packet capture	Detailed protocol evidence	Supports deep forensic investigation	Cost, privacy and storage pressures

Retention policies deserve careful attention. Keeping only a few days of flow data may prevent investigators from proving that a suspicious connection began months earlier. Retaining everything indefinitely may be impractical, so organisations often use longer periods for metadata and shorter, targeted windows for packet-level evidence.

Recovery is part of the same evidence chain. If compromised systems are rebuilt from unsafe copies, the attacker’s foothold may return. Guidance on safe backup restoration reinforces the need to validate backup integrity, scan restored systems and monitor their first network connections closely.

The most effective programmes treat network visibility as a continuing capability rather than a one-off deployment. Baselines must change as staff move between offices, cloud services are introduced and suppliers connect to internal systems. In Sydney, Melbourne or regional locations, the underlying principle remains consistent: unusual communication becomes meaningful when it is tied to assets, identities, timing and business purpose.

The key point to remember is that hidden dwell time is revealed through relationships and sequences, not isolated alerts. Network traffic analysis gives responders the timeline, while integrated identity, endpoint and remediation capabilities help turn that evidence into controlled action.