olemus
ISO 13772:
hälve mingist tavalisest olukorrast
= deviation from a standard condition

näiteid
http://www.tenable.com/sites/drupal.dmz.tenablesecurity.com/files/uploads/documents/whitepapers/Identifying_Malware_by_Observing_Abnormalities.pdf