1. A method for analyzing a stream of network usage data comprising: generating a statistical model from a set of usage data record events from the stream of network usage data; receiving a most recent record event; updating the statistical model using the most recent record event by adding the most recent record event to the statistical model, wherein an identifier is associated with each record event, including updating only a portion of the statistical model associated with the identifier; storing the set of record events in a history cache, and wherein if the history cache is full, updating the statistical model includes removing a least recent record event from the statistical model; and defining the statistical model to include an aggregation of each record event set stored in the history cache; wherein generating a statistical model from the set of record events includes generating an aggregation table for tracking an aggregation of record events associated with an identifier; and wherein the most recent record event is associated with an identifier; and wherein updating the statistical model includes updating only the aggregation of record events in the tracking table for that identifier.