A method of identifying information about a potential attack on a network resource, the method comprising performing by a computer system: receiving (110, 310) a first set of records of requests for target objects of the network resource; analyzing (120, 320) the first set of records to determine a primary identifier for each record, the first set of records having a plurality of different primary identifiers, wherein the primary identifier of a record is a user agent of the request; for each primary identifier of the plurality of different primary identifiers: determining a request number of requests in the first set of records that match one or more criteria, the one or more criteria including the request having the primary identifier; creating a histogram having a plurality of counters, each counter corresponding to a specified number of requests and storing a count of different primary identifiers having a corresponding request number be the specified number of requests; computing an average number of requests for primary identifiers from the counters of the histogram; calculating a standard deviation of the histogram using the plurality of counters and the average number of requests; identifying one or more outlier primary identifiers having the request number exceed a cutoff, wherein the cutoff is the standard deviation of the histogram adjusted by a multiplier; and analyzing the records of requests matching the one or more outlier primary identifiers using a human behavior analysis routine to determine whether the requests are part of an attack on the network resource. receiving (110, 310) a first set of records of requests for target objects of the network resource; analyzing (120, 320) the first set of records to determine a primary identifier for each record, the first set of records having a plurality of different primary identifiers, wherein the primary identifier of a record is a user agent of the request; for each primary identifier of the plurality of different primary identifiers: determining a request number of requests in the first set of records that match one or more criteria, the one or more criteria including the request having the primary identifier; creating a histogram having a plurality of counters, each counter corresponding to a specified number of requests and storing a count of different primary identifiers having a corresponding request number be the specified number of requests; computing an average number of requests for primary identifiers from the counters of the histogram; calculating a standard deviation of the histogram using the plurality of counters and the average number of requests; identifying one or more outlier primary identifiers having the request number exceed a cutoff, wherein the cutoff is the standard deviation of the histogram adjusted by a multiplier; and analyzing the records of requests matching the one or more outlier primary identifiers using a human behavior analysis routine to determine whether the requests are part of an attack on the network resource. determining a request number of requests in the first set of records that match one or more criteria, the one or more criteria including the request having the primary identifier; creating a histogram having a plurality of counters, each counter corresponding to a specified number of requests and storing a count of different primary identifiers having a corresponding request number be the specified number of requests; computing an average number of requests for primary identifiers from the counters of the histogram; calculating a standard deviation of the histogram using the plurality of counters and the average number of requests; identifying one or more outlier primary identifiers having the request number exceed a cutoff, wherein the cutoff is the standard deviation of the histogram adjusted by a multiplier; and analyzing the records of requests matching the one or more outlier primary identifiers using a human behavior analysis routine to determine whether the requests are part of an attack on the network resource.