Embodiments of the present invention provide devices and techniques for detecting anomalies in monitored environments. In one embodiment of the invention, data may be acquired by monitoring an environmental variable. Based on the acquired data, statistics may be calculated which model the behavior of the environmental variable. Based on the calculated statistics, a long-term behavior and a short-term behavior of the statistics may also be calculated. A difference between the long-term statistics and the short-term statistics may then be calculated. If the difference between the long-term statistical behavior and short-term statistical behavior exceeds a dynamic or predefined threshold, an action may be taken.