A method performed by a computer system for identifying abnormal resource usage in a data center, the method comprising: providing resource data for a plurality of resources at various times; for each of the plurality of resources, for each of a plurality of times, identifying current resource usage data for that resource for that time and extracting features from past resource usage data prior to that time; and generating a prediction model for that resource from the current resource usage data and the extracted features for the times to predict resource usage data for that resource at a current time given features extracted from past resource usage data; generating from the predicted resource usage data for the resources error statistics for the prediction models; establishing from the error statistics an abnormal resource usage criterion; and applying a classifier to current resource usage data and the features to determine whether the current resource usage data represents an abnormal resource usage, wherein the classifier, for each of a plurality of resources of the data center, predicts using the prediction model for that resource predicted resource usage data for the current time based on the features and determines an error between the predicted resource usage data and the current resource usage data; and when the determined errors satisfy the abnormal resource usage criterion, indicates an abnormal resource usage has occurred. providing resource data for a plurality of resources at various times; for each of the plurality of resources, for each of a plurality of times, identifying current resource usage data for that resource for that time and extracting features from past resource usage data prior to that time; and generating a prediction model for that resource from the current resource usage data and the extracted features for the times to predict resource usage data for that resource at a current time given features extracted from past resource usage data; generating from the predicted resource usage data for the resources error statistics for the prediction models; establishing from the error statistics an abnormal resource usage criterion; and applying a classifier to current resource usage data and the features to determine whether the current resource usage data represents an abnormal resource usage, wherein the classifier, for each of a plurality of resources of the data center, predicts using the prediction model for that resource predicted resource usage data for the current time based on the features and determines an error between the predicted resource usage data and the current resource usage data; and when the determined errors satisfy the abnormal resource usage criterion, indicates an abnormal resource usage has occurred. for each of a plurality of resources of the data center, predicts using the prediction model for that resource predicted resource usage data for the current time based on the features and determines an error between the predicted resource usage data and the current resource usage data; and when the determined errors satisfy the abnormal resource usage criterion, indicates an abnormal resource usage has occurred.