1. An anomaly detection system comprising: at least one appliance configured to connect to at least one network; and circuitry configured to receive, from the at least one appliance, a status based on at least one of a setting, an operational state, or sensor values associated with the at least one appliance, determine patterns of use for the at least one appliance including at least one time period when the at least one appliance is most likely to be used, determine a normal baseline status based on the patterns of use of the at least one appliance, determine, based on the patterns of use, one or more anomalous events have occurred when an amount of deviation from the normal baseline status for the at least one appliance is greater than a predetermined threshold, detect cyber-attack events based on changes to network configuration settings of the at least one appliance, output alerts, to at least one external device, based on at least one of determining an occurrence of an anomalous event or detection of a cyber-attack event, and update the patterns of use for the at least one appliance based on at least one of the status of the at least one appliance and a response from the at least one external device related to the one or more anomalous events or the cyber-attack events.