The identification of unusual behavior or activity patterns that deviate from normal baselines and may indicate a cyberattack or system compromise.