For example, an attempt to create a setuid file can be caught by examining log messages resulting from system calls. Anomalous intrusions are detected by observing significant deviations from normal behavior. In Denning's approach, a model is built which contains metrics that are derived from system operation. These metrics are computed from available system parameters such as average CPU load, number of network connections per minute, number of processes per user, etc. An anomaly may be a symptom of a possible intrusion.
Anomalous intrusions are harder to detect.
Ideally we would like a system that combined human-like pattern matching capabilities with the vigilance of a computer program. Thus it would always be monitoring the system for potential intrusions, but would be able to ignore spurious false intrusions if they resulted from legitimate user actions.