Highly anomalous data detection in analytics service

A computing device, comprising:

• a processor;
• and
• a non-transitory computer-readable medium having instructions stored thereon that, when executed by the processor, cause the processor to perform operations including:
• identifying one or more maximum values within a set of aggregated values corresponding with a sequence of time spans;
• generating an extreme value distribution based on the one or more maximum values;
• determining a highly anomalous threshold using a confidence threshold and the extreme value distribution based on the one or more maximum values;
• identifying a highly anomalous data value associated with a security-related analysis based on the highly anomalous threshold;
• and
• providing, for display, an indication of the highly anomalous data value associated with the security-related analysis.

A non-transitory computer-readable medium having stored instructions thereon that, when executed by one or more processors, cause the one or more processors to perform operations including:

• identifying one or more maximum values within a set of aggregated values corresponding with a sequence of time spans;
• generating an extreme value distribution based on the one or more maximum values;
• determining a highly anomalous threshold using a confidence threshold and the extreme value distribution based on the one or more maximum values;
• identifying a highly anomalous data value associated with a security-related analysis based on the highly anomalous threshold;
• and
• providing, for display, an indication of the highly anomalous data value associated with the security-related analysis.