A method for detecting network threats, comprising: receiving network traffic generated by a plurality of clients in a network; mapping the network traffic in a network feature space as a first set of client points; forming client groups (502, 504, 506) from the first set of clients points, wherein points in a client group share a center point (508, 510, 512); generating client signature data based at least in part on mapping distances from a second set of client points to one or more of the client groups in the network features space, wherein the client signature data comprises a series of client points that are added to a first window along a first axis, the series of client points comprising a height along a second axis, the height corresponding to the distance from an individual client point from among the series of client points to the one or more of the client groups; initiating a detection phase that identifies abnormal network behavior by: inputting one or more client activity events from the network traffic along the first axis in a second window, and generating a threshold (714, 810) based at least on aggregated client activity points from at least the first window, the threshold corresponding to a set distance from the first axis at least in the second window; and generating alarm data in response to one or more client activity events exceeding a threshold, wherein the threshold is generated based at least in part on a portion of the client signature data. receiving network traffic generated by a plurality of clients in a network; mapping the network traffic in a network feature space as a first set of client points; forming client groups (502, 504, 506) from the first set of clients points, wherein points in a client group share a center point (508, 510, 512); generating client signature data based at least in part on mapping distances from a second set of client points to one or more of the client groups in the network features space, wherein the client signature data comprises a series of client points that are added to a first window along a first axis, the series of client points comprising a height along a second axis, the height corresponding to the distance from an individual client point from among the series of client points to the one or more of the client groups; initiating a detection phase that identifies abnormal network behavior by: inputting one or more client activity events from the network traffic along the first axis in a second window, and generating a threshold (714, 810) based at least on aggregated client activity points from at least the first window, the threshold corresponding to a set distance from the first axis at least in the second window; and inputting one or more client activity events from the network traffic along the first axis in a second window, and generating a threshold (714, 810) based at least on aggregated client activity points from at least the first window, the threshold corresponding to a set distance from the first axis at least in the second window; and generating alarm data in response to one or more client activity events exceeding a threshold, wherein the threshold is generated based at least in part on a portion of the client signature data.