anomaly-based detection
Also written: behavior-based detection, heuristic detection, anomaly detection
Detection that learns what normal traffic looks like and alerts on anything unusual, such as the shop server starting outbound connections. It can catch new attacks, but unusual is not always bad.