1. A method of identifying potential threats on a network comprising: accumulating, by a processor, traffic data from the network over a period of time; calculating, by the processor, a first set of metric values for endpoints communicating on the network from the traffic data; fitting, by the processor, a first mixture distribution to the first set of metric values; identifying, by the processor, outlying metric values based on the mixture distribution; and generating, by the processor, a list of outliers comprising the endpoints having an outlying metric value, wherein a second set of metric values are calculated for the endpoints from the traffic data, wherein a second mixture distribution is fitted to the second set of metric values, and wherein the list of outliers comprises the endpoints having outlying metric values in the first set of metric values and the second set of metric values.