traffic anomaly


traffic anomaly

A deviation from the normal traffic pattern. An intrusion detection system (IDS) may look for unusual traffic activities, such as a flood of UDP packets or a new service appearing on the network. Traffic anomalies can be used to identify unknown attacks and DoS floods, but tuning the IDS for this can be difficult. It also requires a clear understanding of the "normal" traffic. See IDS.