Determinations of whether events are anomalous

A method comprising:

• accessing, by a processor, a set of data points of a file system;
• clustering, by the processor, the data points to assign the data points in the set of data points to a plurality of clusters;
• determining, by the processor, a number of clusters in the plurality of clusters to be used in modeling behaviors of the plurality of clusters;
• for each of the clusters in the determined number of the clusters,
• computing, by the processor, a centroid and a radius of the cluster;
• determining, by the processor, a distribution type of the cluster based on the computed centroid and the radius of the cluster;
• merging, by the processor, the distribution types of the clusters to generate a mixture model;
• and
• determining, by the processor, whether an event is likely anomalous based on an evaluation of the event against the generated mixture model.

A non-transitory computer-readable medium on which is stored computer-readable instructions that when executed by a processor, cause the processor to:

• cluster a set of data points into a hierarchy of a plurality of clusters, wherein each level of the hierarchy includes a different number of the plurality of clusters;
• select a number of the plurality of clusters to be used in modeling behaviors of the plurality of clusters;
• for each cluster of the selected number of the plurality of clusters, determine a distribution type of the cluster;
• merge the distribution types of the clusters to generate a mixture model;
• identify an event;
• evaluate the event based on the generated mixture model to determine whether the event is likely anomalous;
• and
• based on a determination that the event is likely anomalous, execute a response action.