Aspects of the disclosure relate to monitoring an automatic teller machine (ATM) network and determining anomalous fault behavior in the ATM network. A system may determine historical fault volumes in the ATM network and generate a time-series model of the fault volumes. The system may predict future fault volumes based on the generated time-series model. Based on the predicted future fault volumes and actual future fault volumes, the system may determine anomalous fault behavior and perform a remedial action associated with the ATM fault code determined from anomalous observed fault volumes.