1. A computer-implemented method for identifying abnormal hosts, comprising: under control of one or more computer systems configured with executable instructions, receiving host activity data for a plurality of host computer systems, the host activity data for each host computer system being represented as a vector comprising a plurality of values, each value corresponding to a measurement of a host activity category; performing cluster processing on the host activity data of the plurality of host computer systems to yield a plurality of clusters, at least one cluster of the plurality of clusters including a plurality of data points, wherein each data point of the plurality of data points represents host activity data for a different host computer system of the plurality of host computer systems; comparing the yielded plurality of clusters to cluster-processed baseline activity data to determine if there are any abnormal clusters; and at a time after determining the presence of abnormal clusters, providing information identifying one or more abnormal host computer systems having corresponding vectors of host activity data located within the abnormal clusters.