Which feature of CTA can separate statistically normal traffic form anomalous traffic?