how can a baseline help identify suspicious activity on the network