- Two Flavors of Alerts: Signatures and Anomalies
▪ Signatures: Blacklist-based alerts directly indicate badness
→ A malicious protocol, domain, IP, file hash
▪ Anomalies: "An odd, peculiar, or strange condition…" - Dictionary.com
→ User logs in on new computer
→ User logs in from new location
