Some embodiments include tracking events and classifying assets within a computer system. A time series of occurrences of an event type associated with at least one asset is generated. A first signal value and a second signal value is determined based on the time series. The at least one asset can be classified based on comparison of the first signal value and the second signal value. The time series can be based on at least one time window including time intervals. Counters to determine a number of occurrences of an event type can be associated with the time intervals. Each of the counters can be incremented upon occurrence of the event type associated with the at least one asset during an associated time interval.