A model where intrusions are detected by looking for activity that is different from a user's or system's normal behavior.