Measuring the characteristics of expected activity so that changes to it can be more easily identified.
Sources:
CNSSI 4009-2015
from
NIST SP 800-61 Rev. 2
NIST SP 800-61 Rev. 2
under Profiling