olemus
ettemääratud sündmuste avastamine käitumise normaalsest hälbimise põhjal
= detection of predefined events based on anomalies of behavior

ülevaateid
https://www.stamus-networks.com/blog/what-are-the-three-types-of-ids
https://www.intechopen.com/chapters/88343
https://www.larksuite.com/en_us/topics/cybersecurity-glossary/anomaly-based-detection
https://www2.cs.uh.edu/~acl/cs6397/Doc/2009-Elsevier-Anomaly-based%20network%20intrusion%20detection.pdf
https://arxiv.org/pdf/1307.7286.pdf