Patent Document ID: 9712549
Application ID: 14592707
Patent Flag: 1

Claim One:
1. An anomaly detection system comprising: at least one appliance configured to connect to at least one network; and circuitry configured to receive, from the at least one appliance, a status based on at least one of a setting, an operational sate, or sensor values associated with the at least one appliance, monitor the received status of the at least one appliance over one or more periods of time including at least one of a time of day, day of a week, or season to generate historical data for the status of the at least one appliance, determine patterns of use for the at least one appliance by applying learning techniques to the generated historical data of the at least one appliance, determine a normal baseline status based on the patterns of use of the at least one appliance, determine, based on the patterns of use, one or more anomalous events have occurred when an amount of deviation in the status of the at least one appliance from the normal baseline status for the at least one appliance is greater than a predetermined threshold, detect that the one or more anomalous events are cyber-attack events based on changes to network configuration settings of the at least one appliance, classify the one or more anomalous events as at least one of an appliance failure, an attack, and danger to a homeowner based on the status of the at least one appliance and the patterns of use, wherein the circuitry classifies an anomalous event as a danger to homeowner based on an absence of appliance use without a received indication that the homeowner is away from home, update the patterns of use for the at least one appliance based on at least one of the status of the at least one appliance and a response from the at least one external device related to the one or more anomalous events, determine, based on the patterns of use of the at least one appliance, a predetermined sampling rate for receiving the status of the at least one appliance wherein the predetermined sampling rate increases as a probability of use of the at least one appliance increases, and output alerts, to at least one external device, based the determining of an occurrence of an anomalous event and based on the classification of the anomalous event.