A mismatch between routine and expected behavior of a user or organization, and the observed actual behavior. An anomaly could be a signature of an attack.