thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Anomaly-Based Detection

Detecting threats by identifying deviations from an established baseline of normal behavior.

Definition

Anomaly detection can find novel attacks and insider threats that signatures miss, but it tends to produce more false positives and requires training periods. It is used in NDR, UEBA and some IDS products. Statistical and machine-learning models are common.

Example

An alert when a service account suddenly authenticates to 300 hosts it never accessed before.

Exam tip

Anomaly-based finds zero-days but has higher false positives than signature-based.

Related terms