A process-network mismatch is network traffic that does not fit the normal behavior of the application that appears to generate it. Security tools compare a process’s expected destinations, ports, protocols, timing, and volume with what it actually does on the wire. If a browser suddenly talks to an unusual host, uses an odd protocol, or sends regular beaconing that looks more like malware than user browsing, that is a mismatch.
This matters because attackers often hide command-and-control inside trusted programs such as browsers, office apps, or system utilities. That can make hostile traffic blend in with legitimate activity and reduce the value of simple indicators like port scanning or domain blocking alone. Defenders use process-network mismatch detection in EDR, proxy logs, and network monitoring to spot living-off-the-land abuse, malware injection, proxying, and other concealment techniques. In practice, the clue is not just “bad traffic,” but traffic that makes no sense for the process producing it.