A computer-implemented method for detecting an anomalous activity in a network, the method being implemented by one or more computer readable storage devices configured to store computer executable instructions, and by one or more hardware computer processors in communication with the one or more computer readable storage devices configured to execute the computer executable instructions, the method comprising: logging, to the one or more computer readable storage devices, user activity for a plurality of users in the network; sorting the plurality of users into a plurality of cohorts; detecting a new activity by a first user of the plurality of users, wherein the first user is sorted into a first cohort of the plurality of cohorts; determining a geographic region from which the new activity originated; determining attack origin distribution data, wherein the attack origin distribution data includes statistical information of network attacks originating in a plurality of countries, and wherein the attack origin distribution data further includes at least a first probability that network attacks originate from the geographic region; determining network activity origin distribution data, wherein the network activity origin distribution data is based on an analysis of origins of network activity over a period of time, and wherein the network activity origin distribution data further includes at least a second probability of network activity originating from the geographic region, wherein the network activity includes both malicious and non-malicious traffic; determining a third probability of a network attack; generating a statistical probability that the new activity is the network attack based at least in part on a combination of the first probability, the second probability, and the third probability; and generating an indicator of a potential anomaly for display based at least in part on the statistical probability. logging, to the one or more computer readable storage devices, user activity for a plurality of users in the network; sorting the plurality of users into a plurality of cohorts; detecting a new activity by a first user of the plurality of users, wherein the first user is sorted into a first cohort of the plurality of cohorts; determining a geographic region from which the new activity originated; determining attack origin distribution data, wherein the attack origin distribution data includes statistical information of network attacks originating in a plurality of countries, and wherein the attack origin distribution data further includes at least a first probability that network attacks originate from the geographic region; determining network activity origin distribution data, wherein the network activity origin distribution data is based on an analysis of origins of network activity over a period of time, and wherein the network activity origin distribution data further includes at least a second probability of network activity originating from the geographic region, wherein the network activity includes both malicious and non-malicious traffic; determining a third probability of a network attack; generating a statistical probability that the new activity is the network attack based at least in part on a combination of the first probability, the second probability, and the third probability; and generating an indicator of a potential anomaly for display based at least in part on the statistical probability. <EOS>