1. A computer-implemented method for classifying an agent controlling a client device requesting content from a server, comprising: generating a probability look-up table, comprising a plurality of abnormal probability values, each abnormal probability value corresponding to a sequence of events at a corresponding time; receiving, from a server, a first event identifying a first request for content made by a client device to the server; storing the received first event in an evidence vector, together with the time the first request was made; receiving, from the server, a second event identifying a second request for content made by the client device to the server; storing the received second event in the evidence vector, together with the time the second request was made; processing the evidence vector to derive a sequence of events; selecting, from the probability look-up table, a list of abnormal probability values, each abnormal probability value corresponding to the sequence of events; finding an abnormal probability value from the selected list that has a lowest corresponding time among every abnormal probability value in the list that are greater than a predetermined level of confidence; setting a classification time to a time corresponding to the found abnormal probability value, the classification time representing a time at which a probability that an agent controlling the client device is illegitimate exceeds a predetermined threshold; and classifying the agent controlling the client device requesting content from the server as illegitimate, when the time period represented by the difference between the classification time and the time of the first request has elapsed.