Add global SSH anomaly plotting