examines the flow of network traffic for patterns and exceptions to those patterns
looks at the network traffic and distinguishes between normal activity and suspicious activity.
the attempt to gather information about somebody's internet connections by analyzing the timing, length, and destinations of their packets