Abstract: Described herein are techniques for detecting abnormal volume of high cardinality metrics within a system in substantially real time. For example, a device may be configured to model a system as a tree-structure capable of monitoring the volume of data points or contact between users of the system with various nodes of the tree structure. The value of each counter may be normalized based on the value of the counter associated with one or more parent node. The normalized time series may then be compared to one or more thresholds to detect abnormal volumes associated with the node.