There are two methods that an IDS can use to define normal use – some IDS tools use both. One is to compare events to a database of attack strategies, so the definition of normal use is any activity that does not trigger recognition of an attack. The other method is to use AI-based machine learning to record regular activity. The AI method can take a while to build up its definition of normal use.