Zero-day attacks can manifest in various subtle forms and are often difficult to detect. Typically, organizations might experience abnormal scanning activity or an unexpected traffic influx that is coming from one specific client. One way to detect zero-day attacks is by observing software behavior and identifying whether any actions are malicious. Machine learning can also identify data from previously known exploits to establish a baseline to guide future possible exploits. Application logs are a good data source for this method. Techniques such as statistics-based monitoring and behavior-based monitoring are also possible. Statistics-based monitoring is when organizations take statistics from exploits that vendors have detected and feed them into a system to learn and identify these attacks. Behavior-based monitoring is when an organization takes harmful software and purposefully induces a system, identifying any suspicious traffic and scanning through the interactions of the software and the system.