A method for detecting anomalous behavior includes receiving a plurality of historical events that occurred over a time period, identifying respective timestamps of the plurality of events, and grouping the plurality of events into respective time buckets that extend over a predetermined time interval based on the respective timestamps. The method includes identifying a subset of the time buckets that are each associated with a particular first time unit of the plurality of first time units and a particular second time unit of the second plurality of time units, counting a number of the events in each of the subset, and generating a temporal profile including an occurrence rate calculated based on the counted number of events. The method includes receiving detected event(s) that belong to the subset, calculating a probability of observing the event(s) according to the temporal profile, and determining whether the event(s) correspond to an anomalous behavior by comparing the probability to predefined thresholds.