Identifying anomolous device usage based on usage patterns

A computer-implemented method to identify unauthorized use of a device based on a usage pattern. The method includes tracking usage of a device, wherein the usage includes activity by a user interacting with the device. The method includes identifying a usage pattern, wherein the usage pattern is based on usage data. The method further includes generating, based on the usage pattern, a heatmap. The method includes predicting future usage of the device by the user, wherein the predicting includes generating a Markov chain of the predicted future usage. The method also includes determining actual usage is different than the predicted usage. The method further includes calculating, in response to determining the actual usage is different than the predicted future usage, a difference score. The method includes determining the difference score is above a difference threshold, and activating, in response to the difference score being above the difference threshold, an alert.