Glossary: Hardening, Firewalls and Intrusion Detection

Anomaly-based detection

Also written: behavior-based detection, anomaly detection, anomaly

Detection that first learns what normal activity looks like (the baseline) and then flags anything very different. It can catch new attacks but raises more false positives.