Anomaly-Based Detection.

Anomaly-based detection learns what "normal" looks like for a network, host, user, or application — using statistical models, heuristics, or machine learning — and then alerts when observed activity deviates significantly from that baseline. It is the complement to signature-based detection because it can surface unknown threats, insider misuse, novel malware, and stealthy attacks that no signature describes. Implementations include UEBA, NDR/XDR analytics, NetFlow-based behavioural baselining, and DNS-traffic profiling.

The idea dates to Dorothy Denning's 1987 "An Intrusion-Detection Model" (IEEE TSE), which first proposed profiling subjects statistically and alerting on deviation. Its enduring weakness is quantified by the base-rate fallacy: Stefan Axelsson's 2000 analysis showed that when malicious events are extremely rare relative to benign traffic, even a very accurate classifier produces overwhelmingly false alarms, because the tiny prior is swamped by the false-positive rate. This is why anomaly engines demand careful baselining windows, feedback loops, and analyst triage. Modern deployments narrow the problem by scoring anomalies against known attacker behaviour (MITRE ATT&CK), chaining weak signals into a composite risk score, and reserving pure anomaly detection for high-value targets — service accounts, domain controllers, crown-jewel databases — where the baseline is stable and any drift is meaningful.

flowchart LR
  A[Telemetry:<br/>logs, NetFlow, auth] --> B[Learning phase:<br/>build baseline profile]
  B --> C[Baseline model]
  D[Live activity] --> E{Deviation ><br/>threshold?}
  C --> E
  E -->|No| F[Reinforce baseline]
  F --> C
  E -->|Yes| G[Raise anomaly / risk score]
  G --> H{Analyst triage}
  H -->|True positive| I[Investigate & respond]
  H -->|False positive| J[Tune threshold / feedback]
  J --> C

The trade-off is more false positives — legitimate change can look anomalous — so success depends on tuning, enrichment, and feeding analyst verdicts back into the model rather than treating every deviation as an incident.