Query utilization in which a rate of a plurality of queries to a data source may be determined for a plurality of time periods. A cost may be associated with a query state transition. A query state may be assigned to a particular query on a particular time period of the plurality of time periods based on the rate of queries for the particular time period and the cost of the query state transition. A query burst may be identified during the plurality of time periods based on assignment of a query state to the plurality of queries. The query may exhibit a normal query state, a normal-to-deviated query state transition, and a deviated query state. A query burst identification module may identify a query burst during the plurality of time periods, a burst conversion module may convert the query burst to a wavelet using a wavelet transform, a clustering module may apply a clustering technique to the wavelet, and a query classification module may classify the query burst based on applying the clustering technique.