1. A method of identifying potential threats on a network comprising: accumulating traffic data from the network over a period of time; calculating a first set of metric values for endpoints communicating on the network from the traffic data; fitting a first mixture distribution to the first set of metric values; identifying outlying metric values based on the mixture distribution; and generating a list of outliers comprising the endpoints having an outlying metric value.