Anomaly-Based Detection

Anomaly-based detection learns what "normal" looks like for a network, host, user, or application — using statistical models, heuristics, or machine learning — and then alerts when observed activity deviates significantly from that baseline. It is the complement to signature-based detection because it can surface unknown threats, insider misuse, novel malware, and stealthy attacks that no signature describes. Implementations include UEBA, NDR/XDR analytics, NetFlow-based behavioural baselining, and DNS-traffic profiling. The trade-off is more false positives — legitimate change can look anomalous — so deployments require careful baselining windows, feedback loops, threshold tuning, and analyst review to convert anomalies into investigable findings.