A system where a signature or profile is created from the observation of usage over time. this signature is used as a baseline to detect intrusions.