1. A method, comprising: analyzing, by a device in a network, local network data regarding a portion of the network that is local to the device using a first anomaly detection model; analyzing, by the device, the local network data using a second anomaly detection model that was trained in part using remote network data regarding a portion of the network that is remote to the device; comparing, by the device, outputs of the first and second anomaly detection models; identifying, by the device, the local network data as peculiar, in response to the first anomaly detection model determining the local network data to be normal and the second anomaly detection model determining the local network data to be anomalous; mapping, by the device, network metrics derived from the local network data to the output of the first anomaly detection model; scoring, by the device, the network metrics based on the mapping, wherein a score for a particular network metric corresponds to a contribution of the network metric to the output of the first anomaly detection model; and transmitting, by the device, the network metrics and associated scores for display.