Identifying anomolous device usage based on usage patterns

A system comprising:

• a processor;
• and
• a computer-readable storage medium communicatively coupled to the processor and storing program instructions which, when executed by the processor, are configured to cause the processor to:
• track, by a usage manager, usage of a device, wherein the usage includes activity by a user interacting with the device;
• identify, based on the usage, a usage pattern, wherein the usage pattern is based on usage data;
• generate, based on the usage pattern, a heatmap, wherein the heatmap represents a relative probability of the user interacting with a portion of the device, and the heatmap is based on the usage data;
• predict future usage of the device by the user, wherein the predicting includes generating a Markov chain of the predicted future usage;
• determine actual usage is different than the predicted future usage;
• calculate, in response to determining the actual usage is different than the predicted future usage, a difference score;
• determine the difference score is above a difference threshold;
• and
• activate, in response to determining the difference score is above the difference threshold, an alert.

A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing unit to cause the processing unit to:

• track, by a usage manager, usage of a device, wherein the usage includes activity by a user interacting with the device;
• identify, based on the usage, a usage pattern, wherein the usage pattern is based on usage data;
• generate, based on the usage pattern, a heatmap, wherein the heatmap represents a relative probability of the user interacting with a portion of the device, and the heatmap is based on the usage data;
• predict future usage of the device by the user, wherein the predicting includes generating a Markov chain of the predicted future usage;
• determine actual usage is different than the predicted future usage;
• calculate, in response to determining the actual usage is different than the predicted future usage, a difference score;
• determine the difference score is above a difference threshold;
• and
• activate, in response to determining the difference score is above the difference threshold, an alert.