Naturally, you can spoof IP addresses and have the system not know the real cause of the behavior. I don't know of a good way around that other than getting access points to fix their ACLs. Anomalous and normal behavior are a function of the role a system has been deployed in. For victim, the normal behavior is serving web pages. Additionally, it is normal for system administrator to be tailing log files, and building the auto-generated portions of the victim site.
Abnormal behavior is anything else.
The difference between normal and abnormal is not a bold black line though. What is really of interest is the difference between normal behavior, and the behavior currently occurring. This is where the behavioral measurement aspect of our approach applies. For victim we have set these thresholds rather low. Stay Current Subscribe to our Security Alert Newsletter.