A method carried out by a processing device comprising: accessing network traffic from a network (100, 200, 520); storing, for each property of a plurality of properties that are associated with an entity (104, 106, 120, 130, 122a-b, 230-234, 260, 262) communicatively coupled to the network (100, 200, 520), a respective first value of the property, wherein the respective first value of the property is determined based on the network traffic, and each of the plurality of properties are associated with a respective weight that is associated with a priority of a respective one of the plurality of properties; accessing additional network traffic associated with the entity (104, 106, 120, 130, 122a-b, 230-234, 260, 262); determining a respective second value of each property of the plurality of properties based on the additional network traffic; determining, for each property of the plurality of properties, whether the respective first value of the property does not match the respective second value of the property; and for each property within a particular set of the plurality of properties, in response to the respective first value of the property not matching the respective second value of the property, incrementing a counter by as much as an amount of the respective weight; and in response to the counter being greater than a threshold storing an indicator that an anomaly is detected, wherein the particular set is determined based on a type of the detected anomaly and the threshold is associated with the type of the detected anomaly and a device type of the entity (104, 106, 120, 130, 122a-b, 230-234, 260, 261). accessing network traffic from a network (100, 200, 520); storing, for each property of a plurality of properties that are associated with an entity (104, 106, 120, 130, 122a-b, 230-234, 260, 262) communicatively coupled to the network (100, 200, 520), a respective first value of the property, wherein the respective first value of the property is determined based on the network traffic, and each of the plurality of properties are associated with a respective weight that is associated with a priority of a respective one of the plurality of properties; accessing additional network traffic associated with the entity (104, 106, 120, 130, 122a-b, 230-234, 260, 262); determining a respective second value of each property of the plurality of properties based on the additional network traffic; determining, for each property of the plurality of properties, whether the respective first value of the property does not match the respective second value of the property; and for each property within a particular set of the plurality of properties, in response to the respective first value of the property not matching the respective second value of the property, incrementing a counter by as much as an amount of the respective weight; and in response to the counter being greater than a threshold storing an indicator that an anomaly is detected, wherein the particular set is determined based on a type of the detected anomaly and the threshold is associated with the type of the detected anomaly and a device type of the entity (104, 106, 120, 130, 122a-b, 230-234, 260, 261).