Baseline
Also called: baseline of recorded activity
Course: AP® Cybersecurity Shows up in: Unit 3: Securing Networks
A record of normal activity on an uncompromised system, used by anomaly-based detection to spot data types or volumes outside a tolerance range.
Appears in the course and exam description (CED): 3.5.C.2
Why it matters in Unit 3
A baseline only works if it was recorded while the system was clean and traffic was consistent.
Example
A server normally sends about 2 gigabytes a day; 40 gigabytes in one night falls outside the tolerance range and raises an alert.
Learn it properly, with a checkpoint 3.5 Detecting Network Attacks