A system comprising: an anomaly model training engine configured to: sample an embedded software application at a given sampling point to obtain: an activity measure (231, 331, 431) of the embedded software application since a previous sampling point; and application parameters (232, 332, 432) for the embedded software application at the given sampling point; generate training data (240, 340) based on the activity measure (231, 331, 431) and the application parameters (232, 332, 432) obtained for the given sampling point; construct an anomaly detection model using the training data (240, 340), the anomaly detection model configured to provide a determination of whether the embedded software application exhibits abnormal behavior based on activity measure and application parameter inputs; and an anomaly detection engine configured to: sample the embedded software application at the given sampling point during a run-time execution of the embedded software application to obtain an activity measure (231, 331, 431) and application parameters (232, 332, 432) during the run-time execution; determine, during the run-time execution, that the embedded software application enters an inactive execution period, and in response: provide, as inputs to the anomaly detection model, the activity measure (231, 331, 431) and the application parameters (232, 332, 432) sampled during the run-time execution; and determine whether the embedded software application exhibits abnormal behavior based on an output from the anomaly detection model for the provided inputs. sample an embedded software application at a given sampling point to obtain: an activity measure (231, 331, 431) of the embedded software application since a previous sampling point; and application parameters (232, 332, 432) for the embedded software application at the given sampling point; an activity measure (231, 331, 431) of the embedded software application since a previous sampling point; and application parameters (232, 332, 432) for the embedded software application at the given sampling point; generate training data (240, 340) based on the activity measure (231, 331, 431) and the application parameters (232, 332, 432) obtained for the given sampling point; construct an anomaly detection model using the training data (240, 340), the anomaly detection model configured to provide a determination of whether the embedded software application exhibits abnormal behavior based on activity measure and application parameter inputs; and an anomaly detection engine configured to: sample the embedded software application at the given sampling point during a run-time execution of the embedded software application to obtain an activity measure (231, 331, 431) and application parameters (232, 332, 432) during the run-time execution; determine, during the run-time execution, that the embedded software application enters an inactive execution period, and in response: provide, as inputs to the anomaly detection model, the activity measure (231, 331, 431) and the application parameters (232, 332, 432) sampled during the run-time execution; and determine whether the embedded software application exhibits abnormal behavior based on an output from the anomaly detection model for the provided inputs. sample the embedded software application at the given sampling point during a run-time execution of the embedded software application to obtain an activity measure (231, 331, 431) and application parameters (232, 332, 432) during the run-time execution; determine, during the run-time execution, that the embedded software application enters an inactive execution period, and in response: provide, as inputs to the anomaly detection model, the activity measure (231, 331, 431) and the application parameters (232, 332, 432) sampled during the run-time execution; and determine whether the embedded software application exhibits abnormal behavior based on an output from the anomaly detection model for the provided inputs. provide, as inputs to the anomaly detection model, the activity measure (231, 331, 431) and the application parameters (232, 332, 432) sampled during the run-time execution; and determine whether the embedded software application exhibits abnormal behavior based on an output from the anomaly detection model for the provided inputs.