Patent attributes
An anomaly detection system includes appliances connected to a network and circuitry configured to receive statuses of the appliances. Patterns of use are determined for the appliances including time periods in which the appliances are most likely to be used. The circuitry is also configured to determine that anomalous events have occurred when an amount of deviation from a normal baseline status for the appliances is greater than a predetermined threshold. Cyber-attack events are detected based on changes to network configuration settings of the appliances. Alerts are output to an external device based on the one or more anomalous events and/or cyber-attack events related to the appliances. The patterns of use are updated based on the status of the appliances and a response from the external device related to the anomalous events or cyber-attack events.
