A traffic baseline is the normal communication pattern of a network: which hosts talk to each other, which protocols they use, when traffic usually happens, and how much data moves. Teams build baselines from flow data, logs, and long-term observation so they can compare current activity against expected behavior.
In cyber security, baselines are valuable because many attacks stand out as deviations. A new outbound destination, an unusual port, a sudden spike in volume, or traffic at odd hours can indicate malware, command-and-control, lateral movement, or data exfiltration. Defenders also use baselines to reduce false alerts, since normal traffic changes with business cycles, maintenance, and new services. A good baseline makes suspicious behavior easier to spot and investigate.