1. A system comprising: a data collector comprising a first computer, wherein the data collector monitors a computer network; and an anomaly detector comprising one or more computers, wherein the anomaly detector receives monitoring data from the data collector, extracts values for a category of measure from the monitoring data, processes the values for the category of measure to generate a processed value, applies a time decay factor to residual processed values previously received from the data collector to generate time decayed residual processed values, determines an expectation value of the category of measure based at least on the time decayed residual processed values, and determines a deviation of the processed value from the expectation value of the category of measure to detect an anomaly event.