1. A method of identifying potential threats on a network, the method comprising: grouping, by the processing unit, traffic data between endpoints on a network based on a key value; calculating, by the processing unit, a first set of metric values for the traffic data grouped according to the key value and calculating a second set of metric values for the traffic data grouped according to the key value; fitting, by the processing unit, a first mixture distribution to the first set of metric values and a second mixture distribution to the second set of metric values; and identifying, by the processing unit, an endpoint from the endpoints as an outlier, wherein the endpoint identified as the outlier is associated with a metric value from the first set of metric values that does not fit the first mixture distribution and is associated with a metric value from the second set of metric values that does not fit the second mixture distribution.