Detection stage: When the model for the system is available, it is compared with the (parameterized or the pre defined) observed
traffic. If the deviation found exceeds (or is less than when in the case of abnormality models) from a pre defined threshold then
an alarm will be triggered.