A system is provided for detecting abnormal consumption in a distributed water infrastructure. The system may receive from at least one sensor associated with the distributed water infrastructure signals indicative of water usage in the distributed water infrastructure, and aggregate groups of signals to construct a plurality of time-based water event profiles, each water event profile containing a distribution of water usage indicators over time. The system may store a subset of the plurality of water event profiles in memory as normal water event profiles, and receive, from the at least one sensor, signals indicative of current water usage in the distributed water infrastructure. The system may construct, from the signals indicative of current water usage, at least one current water event profile, and compare the at least one current water event profile with normal water event profiles stored in the memory. The system may initiate remedial action if the at least one current water event profile does not substantially correspond to normal water event profiles stored in the memory.