Anomaly-based detection
Course: AP® Cybersecurity Shows up in: Unit 3: Securing Networks
Detection that compares data to a baseline of normal activity and alerts on data outside a tolerance range; catches new attacks but costs more and has more false positives.
Appears in the course and exam description (CED): 3.5.C.23.5.C.43.5.D.2
Why it matters in Unit 3
Works best on networks with consistent traffic; the baseline must come from uncompromised systems.
Example
A printer that never talks to the internet suddenly sends 2 gigabytes out.
Learn it properly, with a checkpoint 3.5 Detecting Network Attacks