Intrusion protection software and hardware looks for unusual activity that touch on anomalies and events in the NIST Detect Framework function. An anomaly is something that has taken place which would not usually take place.