Yes, for your first point, you seem to be considering behavioral monitoring where we attempt to characterize the behavior of a healthy or normal system and decr

Yes, for your first point, you seem to be considering behavioral monitoring where we attempt to characterize the behavior of a healthy or normal system and decree and declare everything else a sick system or an anomaly. Yes, of your second, an example seems to be detecting malware in communications data streams or hard disk files by looking for specific, characterizing patterns of bits, that is, signatures extracted from earlier detections of such malware. In behavioral monitoring, we might have challenges with false alarm rate.