Use of software tools to detect behavior on a network that is outside of norms. Compare baselining; contrast signature-based detection.