1. A method for detecting an anomaly in behavior of an airborne autonomous mobile node, the method comprising: determining a predictive model for an action of the airborne autonomous mobile node, based on measurement data from one or more sensors onboard the airborne autonomous mobile node; and based on the determined predictive model, detecting the anomaly in the action of the airborne autonomous mobile node, wherein determining the predictive model for the action of the airborne autonomous mobile node comprises: receiving the measurement data from the one or more sensors onboard the airborne autonomous mobile node, the measurement data being related to the action of the airborne autonomous mobile node when the airborne autonomous mobile node performs the action; storing the received measurement data as present observation data about the action of the airborne autonomous mobile node; determining a prediction rule for the action of the airborne autonomous mobile node, based on the received measurement data, the prediction rule comprising a condition, an action, and a prediction; determining whether there exists a first prediction about the action of the airborne autonomous mobile node; when it is determined that there exists a first prediction about the action of the airborne autonomous mobile node, determining whether there exists a surprise between the present observation data and expected observation data relating to the action of the airborne autonomous mobile node, the surprise comprising a difference between the present observation data and the expected observation data; upon determining that the surprise exists between the present observation data and the expected observation data, identifying a potential cause for the surprise based on previous observations; and updating the predictive model based on the identified potential cause of the surprise.