The practice of looking for and recognizing unusual behavior against the background of an established baseline as a means of detecting hostile or otherwise dangerous activity in a network or system. Contast signature-based detection.