Definition
Anomaly detection is a cybersecurity technique used to identify unusual patterns or deviations from normal behavior within a system or network. It works by establishing a baseline of typical activity and then flagging any data points that significantly differ from this established norm. This capability is crucial for proactively identifying potential security threats or operational issues before they cause significant damage. For instance, an anomaly detection system might flag an unusual spike in outbound network traffic from a server as a potential indicator of data exfiltration. While it identifies deviations, it does not automatically determine the cause, distinguishing it from intrusion detection systems that often have predefined attack signatures. This concept is frequently tested on certifications like CompTIA Security+, CySA+, and CISSP.