1. A method comprising: retrieving, using one or more computing devices, event data describing one or more endorsement events; determining, using the one or more computing devices, activity data associated with the one or more endorsement events; aggregating, using the one or more computing devices, the activity data to an aggregation level, wherein aggregating the activity data comprises: determining the aggregation level; generating an aggregation value for the aggregation level from the activity data, the aggregation value representing a number of endorsement events performed in the aggregation level; and storing the aggregation value in an aggregation table; detecting using the one or more computing devices, based at least in part on the aggregation level of the activity data, one or more anomalies, wherein the one or more anomalies represent suspicious behavior associated with the one or more endorsement events; and taking, using the one or more computing devices, one or more protection actions responsive to the detection of the one or more anomalies.