Cybersecurity glossary
What is Anomaly Detection?
Learn what anomaly detection is in security operations, how baselines and statistical or ML models flag unusual behavior, where they fail, and how to combine them with signature detections.
Definition
Anomaly detection is the practice of identifying activity that deviates from an established baseline of normal behavior—across users, hosts, networks, or applications—so defenders can investigate potentially malicious or erroneous events that no static signature described in advance.
Why known-bad lists are never complete
Zero-days, living-off-the-land, and insiders do not always match last week’s hash. Anomaly detection asks a different question: is this identity, host, or traffic pattern unlike its own history (or unlike its peers) in a way that matters?
The power is novelty. The tax is explanation: an analyst still has to decide whether “weird” is “wrong.”
Baselines worth building
Identity and access
Logon times, geo, device mix, privilege use, and SaaS apps a person has never touched.
Host and process
Rare children of Office, new persistence locations, or unusual outbound volumes from a laptop.
Network and DNS
Beacon-like intervals, newly seen domains, and protocol mixes that do not match the subnet’s job.
Data and application
Export size, object access far outside a role, and API error storms from a single token.
How an anomaly pipeline should run
Choose the entity
Score a user, service account, host, or tenant—not a raw IP that thousands share.
Build a fair baseline
Enough history, peer groups, and calendar awareness so month-end is not a daily incident.
Feature with care
Counts, rarity, sequence, and sensitivity of the resource beat unexplained embeddings alone.
Threshold and combine
Pair scores with independent signals (new device, impossible travel, DLP hit) before paging.
Explain to a human
Show which features moved. Opaque “risk 87” without a story will be ignored.
Failure modes unique to anomalies
| Failure | Why it happens | Mitigation |
|---|---|---|
| Poisoned baseline | Attacker dwells long enough to become “normal” | Peer comparison and absolute rare-event rules |
| Concept drift | New VPN, merger, or WFH patterns | Retrain windows and change-aware suppression |
| Peer-group errors | Executives scored against interns | Role, department, and asset-tier groupings |
| Alert storms | One outage makes every host anomalous | Cluster by change ticket and suppress correlated bursts |
- Declare the entity and the hypothesis (“impossible SaaS admin from a new device”), not only a model name.
- Keep a signature/TTP layer for known-bad; anomalies are complementary.
- Require feature-level explanations on any paged anomaly.
- Exclude change windows and known scanners from training and from alerting.
- Measure precision per entity type; laptop users are not cloud control planes.
- Watch for attackers who trickle activity to train your baseline.
- Use anomalies to hunt first when precision is unproven.
- Retire scores nobody can investigate; mystery ML is not coverage.
The practical takeaway
Anomaly detection finds the activity no IOC described—if the baseline is honest, the entity is real, and a human can understand the score. Combine it with behavioral TTPs, or “unusual” will just mean “busy Tuesday.”
Related security terms
Detection Engineering
Must specify hypotheses and tests even for statistical detections.
Alert Fatigue
Unexplained anomaly scores are a common source of ignored pages.
False Positive
Baseline drift and rare-but-benign work create noisy outliers.
Log Correlation
Joins that give anomaly models the right entities to score.
Mean Time to Detect (MTTD)
Anomalies can shrink dwell time when they catch unknown procedures.
Frequently asked questions
What is anomaly detection in simple terms?
It is noticing that something is unusually different from the usual pattern—a user who never downloads payroll suddenly exporting it at 3 a.m.—without needing a malware hash first.
How is it different from signature or IOC detection?
Signatures match known-bad patterns. Anomaly detection flags deviation from learned or declared normal, so it can catch novel malware and insider misuse—and also catch Tuesday’s unusual-but-legitimate deploy.
What is UEBA?
User and Entity Behavior Analytics is a product category that scores users, hosts, and services for anomalous behavior. It is one implementation of anomaly detection, not a synonym for all of it.
Does machine learning always outperform rules?
No. A well-specified rule on a rare admin API can beat an opaque score. ML helps when the feature space is large and “normal” is too complex to enumerate.
Why do anomaly systems cry wolf?
Bad baselines (too short, too broad), missing peer groups, seasonality (month-end close), and scoring entities that are not actually comparable.
Should every anomaly page the SOC?
Usually no. Use scores to enrich, cluster, or hunt. Page when the anomaly aligns with a high-impact asset or a second independent signal.
How do you test anomaly detections?
Replay known incidents, inject synthetic outliers, and track precision by entity type. If analysts cannot explain the score, treat it as a research signal, not an on-call alert.
References
Explore authoritative guidance and frameworks related to anomaly detection.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.