A method includes receiving sensor data over time from each node of a plurality of sensory nodes located within a building. The method also includes determining a sensor specific abnormality value for each node of the plurality of sensory nodes. The method further includes determining, a building abnormality value in response to a condition where the sensor specific abnormality value for multiple nodes of the plurality of sensory nodes exceeds a threshold value. The method also includes causing an alarm to be generated based on the building abnormality value.