Techniques and structures to facilitate anomaly detection within a networking system, including receiving a plurality of performance metric messages at a database system, extracting a plurality of anomaly detection messages included in the performance metric messages, storing the plurality of anomaly detection messages in an in-memory database and executing a machine learning model to process the plurality of anomaly detection messages in the in-memory database to detect whether anomalous usage of the networking system has been detected.