1. A method of using a computer to detect anomalies in the data traffic of a mobile device, comprising the steps of: collecting from the mobile device, usage data relating to data usage for the mobile device for a given time period; setting threshold values based at least in part on a mobile device data plan and an amount of data used within a set time period and on historical usage data, where the weighting afforded the historical usage data is equivalent to the amount of stored history; comparing with a computer, the usage data against the threshold values; identifying an anomaly with the computer if a statistic of the usage data exceeds a corresponding threshold of the threshold values; updating the threshold values based on a running average of each statistic of the usage data.