Glossary: Security Monitoring and Automation

anomaly detection

Also written: anomaly, anomalies, anomaly-based detection

Learning what normal activity looks like (the baseline) and flagging anything that differs from it a lot. It needs no signature, so it can catch new attacks, but unusual isn't always bad.