Detecting anomalous activity from accounts of an online service

A computer-readable storage medium storing computer-executable instructions for detecting anomalous activity in an online service, comprising:

• accessing a baseline profile comprising past event information related to events comprising security events that originate from accounts of the online service;
• accessing a recent profile comprising recent event information related to recent events comprising the security events that originated within a last day from accounts of the online service;
• comparing the baseline profile to the recent profile and when the baseline profile and the recent profile are different then detecting anomalous activity;
• and
• reporting the anomalous activity when detected.

A system for detecting anomalous activity in an online service, comprising:

• a processor and memory;
• an operating environment executing using the processor;
• and
• an anomaly detector that is configured to perform actions comprising:
• accessing a baseline profile comprising past event information related to events comprising security events that originate from accounts of the online service;
• accessing a recent profile comprising recent event information related to recent events comprising the security events that originated within a last day from accounts of the online service;
• comparing frequencies of past event information in the baseline profile to frequencies of the recent event information in the recent profile to determine when anomalous activity is detected in the online service;
• and
• reporting the anomalous activity when detected.