A method is provided to estimate statistics of user interaction with a computing system. For example, the method includes tracking the interaction of a plurality of users with the computing system to collect statistical data associated with the user interaction, wherein the statistical data is collected in each of a plurality of sampling intervals. The collected statistical data is applied to a digital linear recursive filter that is configured to combine and filter the collected statistical data based on at least one cyclical function. The filtered statistical data generated by the digital linear recursive filter is then utilized to compute final statistics indicative of the user interaction with the computing system. The final statistics are utilized to identify anomalous activity involving the computing system.