US Patent 7523016 Detecting anomalies

In general, systems and methods for identifying anomalous activity are described. For example, systems and methods are described, in which patterns of unusual behavior can be identified by aggregating logged, or sampled, data into cells and annotating each cell with statistically derived measures of how extreme the cell is relative to, for example, historical behavior of corresponding characteristics or relative to, for example, behavior of characteristics from a general population. Cells that have more than a predefined number of such annotations can be identified as anomalous and can be investigated by a user or outright acted upon in an automatic, pre-defined way.