A computing device receives one or more network communication anomaly conditions that indicate abnormal network communication traffic for a class of devices associated with the computing device; monitors network communication data of the computing device; determines whether the network communication data of the computing device satisfies the one or more network communication anomaly conditions; and responsive to determining that the network communication data of the computing device satisfies the one or more network communication anomaly conditions, performs an anomaly detection operation for the computing device.