Abstract: A hosted service monitoring system detects abuse of a hosted service by monitoring user actions over a period of time. The system will identify an entity, which is a subset of the user actions that share one or more features in common. The system will also identify feature statistics to measure how often the features are associated with the user actions in the entity. The system will project the feature statistics to a vector and use the vector to generate an anomaly score for the entity. The system will determine that the entity is associated with an automated initiator if it generates an anomaly score that exceeds a threshold. Upon determining that the entity that is associated with an automated initiator, the system will cause the hosted service to take an action that will block the automated initiator from accessing the hosted service.