Abstract: In some embodiments, a network event initiation detection engine may access a time series event data store containing indications for each of a series of received network events, including a time value. The network event initiation detection engine may then perform a statistical analysis on the information in the time series event data store, including the time values. The statistical analysis may be, for example, associated with durations of time existing between events. Based on the statistical analysis, a result may be output associated with a network event initiation likelihood. The result might indicate, for example, that an event was machine-initiated, human-initiated, etc.