Abstract: An anomaly score is computed for current and past physical access events using machine learning models. A transformation of the security events history into a time series of event counts, or augmenting the events history with the delay/lag information is used as an input to machine learning models. Machine learning models are used to estimate (compute) probability density functions for the currently observed parameters of security events. Cumulative probability density functions are computed from the probability density functions to be used to compute the anomaly score for the security events. The described method utilizes a collection of machine learning models to improve efficiency, accuracy and computation speed, by training the models on only a small subset of the accumulated history of security events to achieve higher performance of anomaly detection by narrow specialization of the models. When the anomaly score is beyond a threshold, injecting an anomaly alert network packet.