SECAI Core · phase 13 of 15
Anomaly detection
The process of evaluating traffic flows and communications across the network and comparing the current activity levels with baselines of normal activity
The Explain card
- Plain English
- Anomaly detection compares current network traffic and communications against a baseline of normal activity and raises a flag when something deviates from it.
- Example
- An internal model-serving endpoint normally sees a few hundred requests a day from the application. One night it sees fifty thousand small, systematic queries from a single host, a classic sign of a model extraction attempt.
- Why it matters
- Attacks on AI systems often use legitimate requests in abnormal volumes or patterns. Signatures miss them, but deviation from baseline catches them.
- Hook
- You cannot spot weird until you have measured normal.
Where it sits in the deck
Phase 13: Detection, Monitoring, and Threat Intelligence
Defences eventually fail — learn how to detect, correlate, and investigate anomalies in real time across both AI-specific and traditional security telemetry.
