A deviation from normal network traffic patterns that is detected by an intrusion detection system. A traffic regulation anomaly could indicate a denial-of-service attack or a hacker who is monitoring connections to a Web server.