Methods and apparatuses for determining whether an anomalous event occurred locally at a first entity

A method for determining whether an anomalous event occurring at first entity within a system has occurred locally at the first entity, wherein the system comprises a plurality of entities comprising the first entity, the method comprising:

• receiving data from the plurality of entities indicative of whether or not an anomalous event is occurring at each of the plurality of entities over a first time period;
• characterizing the system, based on the received data and a system characterization model, as one of:
• a system in which only the first entity is experiencing an anomalous event at any one time;
• a system in which two or more of the plurality of entities are experiencing anomalous events occurring at any one time;
• and
• a system for which during at least one second time period within the first time period data is missing for one or more of the plurality of entities;
• and
• utilizing one or more of a plurality of anomaly detection models to compare the data received from the first entity to the data received from other entities in the plurality of entities;
• and
• responsive to an output of any of the one or more of the plurality of anomaly detection models indicating that the anomalous event has occurred locally at the first entity:
• determining that a local anomalous event has occurred at the first entity;
• and
• assigning a confidence level to the determination that the local anomalous event has occurred at the first entity, wherein the confidence level is based on the characterization of the system.