A network anomaly can be described as one or more actions or attributes that are commonly associated with malicious activity. Additionally, in order for something to be considered a network anomaly rather than a behavioral anomaly, it must come from several different devices – not just one device or one human on one device.