US Patent 9954882 Automatic baselining of anomalous event activity in time series data

Software that automatically detects anomalous attributes indicative of a potential intrusion in a computing system. The software performs the following operations: (i) determining a baseline pattern for one or more attributes of a computing system, based on a first set of statistical thresholds determined for received values of the one or more attributes, wherein the received values correspond to one or more time periods, and on a second set of statistical thresholds determined for a first subset of values of the received values of the one or more attributes, wherein each value of the first subset exceeds the first set of statistical thresholds; and (ii) in response to identifying, based on the determined baseline pattern, anomalous values in monitored additional values of the one or more attributes, sending an alert to a user of the computing system indicating that a potential intrusion in the computing system has occurred.