1. A method for detecting outlier users of a network resource comprising: monitoring stream data associated with a subscriber's usage of a network resource for a predetermined time interval; deriving, from the stream data, a flow-count history, where a flow is a communicative connection between a particular source IP address and transport layer port to a particular destination IP address and transport layer port in which all of the packets are using the same protocol, and a flow-count history is a count of the number of flows the subscriber initiates as either the source IP address or destination IP address during a predetermined time period; deriving, from the stream data, byte data associated with the subscriber's usage of the network resource for the predetermined time interval for developing a byte-usage history; applying an outlier detection logic to the byte-usage history as compared to a plurality of other byte-usage histories associated with a plurality of other subscribers; assigning a byte-usage band to the subscriber based on the outlier detection logic as applied to the byte-usage history; applying the outlier detection logic to the flow-count history as compared to a plurality of other flow-count histories associated with a plurality of other subscribers; assigning a flow-count band to the subscriber based on the outlier detection logic as applied to the flow-count history; assigning an overall usage-band to the subscriber based on the byte-usage band assigned and the flow-count band assigned; and applying a mitigating action to the subscriber based on the overall usage-band assigned.