Alerts based on historical event-occurrence data

A system comprising:

• at least one processor;
• and
• one or more non-transitory computer readable storage media containing instructions executable by the at least one processor for causing the at least one processor to perform operations comprising:
• generating a plurality of baseline results of an aggregation operation performed with respect to a detection set of one or more attributes of event records in a database, each baseline result in the plurality of baseline results corresponding to a baseline set of one or more of the event records, each such baseline set corresponding to a baseline time period in a plurality of baseline time periods within a baseline time window, each such baseline time period having a first duration;
• applying a statistical function to the plurality of baseline results to select a particular baseline result of the plurality of baseline results, the particular baseline result that is selected representing a particular baseline set of the one or more of the event records that is associated with a particular baseline time period of the plurality of baseline time periods;
• determining a subject result of the aggregation operation performed with respect to the detection set of one or more attributes of a subject set of one or more event records in the database, the subject set corresponding to a subject time period having the first duration;
• determining, based on at least the particular baseline result and the subject result, whether the subject result indicates an alert condition for the detection set for the subject time period by performing operations comprising:
• generating a modified baseline result based on the particular baseline result by multiplying the particular baseline result by a scaling coefficient;
• comparing the subject result to the modified baseline result;
• and
• determining whether the subject result indicates an alert condition for the detection set for the subject time period based on the comparison;
• and
• based on determining that the subject result indicates the alert condition, outputting one or more alerts.

A computer-storage medium containing instructions executable by at least one processor for causing the at least one processor to perform operations comprising:

• generating a plurality of baseline results of an aggregation operation performed with respect to a detection set of one or more attributes of event records in a database, each baseline result in the plurality of baseline results corresponding to a baseline set of one or more of the event records, each such baseline set corresponding to a baseline time period in a plurality of baseline time periods within a baseline time window, each such baseline time period having a first duration;
• applying a statistical function to the plurality of baseline results to select a particular baseline result of the plurality of baseline results, the particular baseline result that is selected representing a particular baseline set of the one or more of the event records that is associated with a particular baseline time period of the plurality of baseline time periods;
• determining a subject result of the aggregation operation performed with respect to the detection set of one or more attributes of a subject set of one or more event records in the database, the subject set corresponding to a subject time period having the first duration;
• determining, based on at least the particular baseline result and the subject result, whether the subject result indicates an alert condition for the detection set for the subject time period by performing operations comprising:
• generating a modified baseline result based on the particular baseline result by multiplying the particular baseline result by a scaling coefficient;
• comparing the subject result to the modified baseline result;
• and
• determining whether the subject result indicates an alert condition for the detection set for the subject time period based on the comparison;
• and
• based on determining that the subject result indicates the alert condition, outputting one or more alerts.