Systems and methods are disclosed herein for identifying an anomaly in a signal, where samples in the signal correspond to an amount of data flow in a network within a time interval, and an anomaly corresponds to at least one sample in the discrete signal having a likelihood value below a likelihood threshold. A historical probability distribution of the discrete signal is generated based on previously received samples. For each sample in a plurality of samples in the discrete signal, a likelihood is computed based at least in part on the historical probability distribution. A likelihood threshold is selected, and a set of consecutive samples is identified as an anomaly when each sample in the set has a computed likelihood below the likelihood threshold.