The disclosed teachings relate to intruder detection. Some of the subject matter described herein includes a computer-implemented method for detecting physical movement using a wireless mesh network that provides wireless data communication, the wireless mesh network having a plurality of mesh points, each mesh point having a wireless coverage, the method including compiling a database of known devices based on monitoring unique identifiers of known devices that have previously conducted communication with the wireless mesh network through the plurality of mesh points; upon detecting a physical presence of a subject device within a physical space of the wireless mesh network, determining, based on the database of known devices, whether the physical presence of the subject device belongs to an anomaly; and when the physical presence of the subject device is determined to be an anomaly, causing a security action to be performed.