Dwell-time anomaly detection.