looks at the network traffic and distinguishes between normal activity and suspicious activity.
examines the flow of network traffic for patterns and exceptions to those patterns
analysis that asks how much traffic must flow over each of the network's many individual transmission links.