This thesis focuses on anomaly detection for passive monitoring of satellite Internet traffic. It starts by outlining the satellite communication context and the characteristics of EUTELSAT customer traffic, supported by a review of related and competitor studies. The work then builds a scalable processing pipeline to transform raw monitoring logs into structured data, enabling consistent analysis on large volumes of traffic. Using the aggregated dataset, the thesis develops a multi-step analysis of user behavior: initial exploration of traffic patterns and outliers, profiling of service usage, and a shift from purely volume-based metrics to behavioral indicators. These macro-level steps provide a clearer view of how users differ and where anomalous behaviors may emerge.