1. A method of identifying information about a potential attack on a network resource, the method comprising performing by a computer system: receiving a first set of records of requests for target objects of the network resource; analyzing the first set of records to determine a primary identifier for each record, the first set of records having a plurality of different primary identifiers; for each primary identifier of the plurality of different primary identifiers: determining a request number of requests in the first set of records that match one or more criteria, the one or more criteria including the request having the primary identifier; creating a histogram having a plurality of counters, each counter corresponding to a specified number of requests and storing a count of different primary identifiers having a corresponding request number be the specified number of requests; computing an average number of requests for primary identifiers from the counters of the histogram; calculating a standard deviation of the histogram using the plurality of counters and the average number of requests; identifying one or more outlier primary identifiers having the request number exceed a cutoff, the cutoff being based on the standard deviation of the histogram; and analyzing the records of requests matching the one or more outlier primary identifiers to determine whether the requests are part of an attack on the network resource.