The attacker was an American born citizen who had a decent paying job (the news said around 75,000), and had no record prior to this. He also got married to a woman he met on a Muslim dating site, and he asked that she be religious and wear the hajib.
He and his wife even had a little kid. When some of the commentators were talking about him, they said there was almost nothing to raise a flag on him. He went to Saudi Arabia twice, once for pilgrimage and once to get married, and he also visited Pakistan once, because that is where his wife was from.
According to the interview that his Imam gave, he was considered to be a pretty mellow guy that was friendly and didn't really stand out. The only thing he noticed concerning the attacker was that he stopped going to mosque a few weeks ago.
Outside of checking his phone records and looking at where he went on the 'net, there was nothing to single him out until the attack.
How can we defend against someone who has no prior record, doesn't seem to act strange in the community, and basically follows the law until they snap?
Dunno. But then again, we don't catch domestic terrorists many times until AFTER they have gone and made their attack.