SECAI Core · phase 13 of 15 · noun

Anomaly detection

The process of evaluating traffic flows and communications across the network and comparing the current activity levels with baselines of normal activity

The Explain card

Plain English
Anomaly detection compares current network traffic and communications against a baseline of normal activity and raises a flag when something deviates from it.
Example
An internal model-serving endpoint normally sees a few hundred requests a day from the application. One night it sees fifty thousand small, systematic queries from a single host, a classic sign of a model extraction attempt.
Why it matters
Attacks on AI systems often use legitimate requests in abnormal volumes or patterns. Signatures miss them, but deviation from baseline catches them.
Hook
You cannot spot weird until you have measured normal.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

A network gateway uses anomaly detection to flag an unusual burst of outbound requests from a model-serving cluster.

Why these words
  • anomaly Greek anōmalia, irregularity or unevenness identifies the unexpected or irregular item
  • detection Latin detegere, to uncover names the act of discovering or identifying something
Where it came from
Origin
an English compound formed from anomaly, ultimately Greek anōmalia, and detection, from Latin detegere
Entered the language
20th century
What changed
The older senses of irregularity and uncovering combined into a technical phrase used in statistics, engineering, computing, and cybersecurity.
How it is spelled
Pattern
anomaly changes final y to ies in the plural: anomalies
Pattern
detection retains the consonant cluster ct before the suffix ion

Spelled like

  • economy
  • taxonomy
  • selection
  • inspection
Broken into chunks
  • anomal
    • anomalous
    • anomalistic
  • detect
    • detector
    • detective
  • -ion
    • inspection
    • prediction
What it sits beside

Same subject

  • intrusion detection
  • network monitoring
  • threat detection
  • behavioral analytics

Same shape

  • outlier detection
  • fraud detection
  • malware detection

anomaly detection approaches

  • supervised anomaly detection
  • unsupervised anomaly detection
  • semi-supervised anomaly detection

Where it sits in the deck

Phase 13: Detection, Monitoring, and Threat Intelligence

Defences eventually fail — learn how to detect, correlate, and investigate anomalies in real time across both AI-specific and traditional security telemetry.

Neighbours in this phase