Identifying anomalies in a network

An anomaly detector comprising:

• a processor provided to execute computer readable instructions included on a non-transitory memory;
• and
• a non-transitory memory including computer readable instructions, that when executed by the processor, cause the anomaly detector to:
• generate a characteristic indicator that characterizes a device type based on communications associated with a first device of the device type, wherein the characteristic indicator indicates a threshold for the device type;
• determine, based on communications associated with the first device, a performance indicator that indicates a performance of the first device;
• and
• synthesize an anomaly indicator in response to the performance indicator breaching the threshold for the device type.

A non-transitory computer readable storage medium storing one or more programs, the one or more programs comprising instructions, which, when executed by an anomaly detector with a processing device, cause the anomaly detector to perform or cause performance of:

• generating a characteristic indicator that characterizes a device type based on communications associated with a first device of the device type, wherein the characteristic indicator indicates a threshold for the device type;
• determining, based on communications associated with the first device, a performance indicator that indicates a performance of the first device;
• and
• synthesizing an anomaly indicator in response to the performance indicator breaching the threshold for the device type.