Designed to uncover abnormal patterns of behavior, the IDS establishes a baseline of normal usage patterns, and anything that widely deviates from it gets flagged as a possible intrusion.

• 有计划地分析异常行为的模式，然后IDS建立一条正常使用模式的基准线，那么任何行为只要背离的这个基准就当作可能的入侵来看待。