Flagging usage that deviates from a user's or template's own historical baseline.
Statistical anomaly detection (e.g. deviation from a rolling baseline) over structured usage data.
Standard statistical/anomaly-detection libraries