What is meant by normalization? Occurs when an intrusion detection system labels normal activity as anomalous. The process of translating log files from various systems into a common format. Occurs when an intrusion detection system overlooks anomalous activity. The process of translating and reformatting raw log files into useful reports