Abstract: An embodiment of the present invention is directed to an optimal event-driven anomaly detection scheme. The present invention recognizes that anomaly detection based solely on rules-based (deterministic) or probabilistic analysis alone are insufficient to capture and respond to ever evolving, highly sophisticated threats that tend to persist within a system undetected for long periods of time. According to an embodiment of the present invention, a tiered detection scheme composed of behavioral analysis and machine-learned probabilistic system behaviors provides an optimal level of sensitivity to detect and respond to threats, and further limits the number of false positives identified.