Systems and methods for detecting anomalous behavior

A system, comprising:

• a memory;
• and
• at least one device comprising a processor configured to execute instructions stored in the memory to:
• monitor at least one of calls or traffic on a network,
• identify behavior associated with each of a plurality of user devices with respect to activity on the network,
• aggregate information about the behavior associated with the plurality of user devices,
• determine whether the aggregated information corresponds to an anomaly with respect to usage of the network,
• determine, when the aggregated information corresponds to the anomaly, whether the anomaly meets a threshold based on a type of anomaly and a number of user devices affected by the anomaly,
• identify, when the anomaly meets the threshold, an area affected by the anomaly,
• identify, when the aggregated information corresponds to the anomaly, user devices in the area affected by the anomaly,
• generate a notification in response to determining that the aggregated information corresponds to the anomaly, and
• transmit the notification to the identified user devices in the area affected by the anomaly.

A non-transitory computer-readable medium having stored thereon sequences of instructions which, when executed by at least one processor, cause the at least one processor to:

• monitor at least one of calls or traffic on a network;
• identify behavior associated with each of a plurality of user devices with respect to activity on the network;
• aggregate information about the behavior associated with the plurality of user devices,
• determine whether the aggregated information corresponds to an anomaly with respect to usage of the network;
• determine, when the aggregated information corresponds to the anomaly, whether the anomaly meets a threshold based on a type of anomaly and a number of user devices affected by the anomaly;
• identify, when the anomaly meets the threshold, an area affected by the anomaly,
• identify, when the aggregated information corresponds to the anomaly, user devices in the area affected by the anomaly;
• generate a notification in response to determining that the aggregated information corresponds to the anomaly;
• and
• transmit the notification to the identified user devices in the area affected by the anomaly.