"Engineers have spent decades developing systems that flag observed deviations from learned normal behavior."
Denning's 1987 intrusion-detection research proposed monitoring system activity against statistical profiles of normal behavior and identifying anomalous observations. It establishes the historical roots of using an additional monitoring mechanism to detect unexpected behavior during system operation.
View Source