A system comprising a content server in communication with a plurality of devices (10A-10n), wherein the content server is configured to: communicate with the plurality of devices; receive digital behavior data and identifying information from one or more respective devices of the plurality of devices; associate the digital behavior data and identifying information received from the respective device with the respective device; wherein the digital behavior is originated by the respective device over a period of time that includes sampling of digital behavior data of a plurality of operation cycles of the respective devices; generate a device profile (12A-12n) for the respective device defined by the digital behavior data associated with the respective device; identify a plurality of device populations, wherein each respective device population is defined by at least one respective element of the identifying information; populate the respective device population with one or more respective devices associated with the at least one respective element of the identifying information; generate a population profile for the respective device population defined by the digital behavior data of the respective devices populating the respective device population; store the device profiles and the population profiles; wherein the content server is configured to receive and provide content related to at least one of the device profiles and the population profiles; compare a profile over time to a baseline profile to determine an abnormality therebetween; wherein: the profile over time is defined by one of a device and a population; the baseline profile is defined by the same one of the device and the population; the profile is defined by a power consumption pattern; and provide an alert when the abnormality is detected; wherein the abnormality is related to an intrusion of the one of the device and the population defining the profile. communicate with the plurality of devices; receive digital behavior data and identifying information from one or more respective devices of the plurality of devices; associate the digital behavior data and identifying information received from the respective device with the respective device; wherein the digital behavior is originated by the respective device over a period of time that includes sampling of digital behavior data of a plurality of operation cycles of the respective devices; generate a device profile (12A-12n) for the respective device defined by the digital behavior data associated with the respective device; identify a plurality of device populations, wherein each respective device population is defined by at least one respective element of the identifying information; populate the respective device population with one or more respective devices associated with the at least one respective element of the identifying information; generate a population profile for the respective device population defined by the digital behavior data of the respective devices populating the respective device population; store the device profiles and the population profiles; wherein the content server is configured to receive and provide content related to at least one of the device profiles and the population profiles; compare a profile over time to a baseline profile to determine an abnormality therebetween; wherein: the profile over time is defined by one of a device and a population; the baseline profile is defined by the same one of the device and the population; the profile is defined by a power consumption pattern; and the profile over time is defined by one of a device and a population; the baseline profile is defined by the same one of the device and the population; the profile is defined by a power consumption pattern; and provide an alert when the abnormality is detected; wherein the abnormality is related to an intrusion of the one of the device and the population defining the profile.