The present invention comprises a method and software for recognizing and flagging a data item used by one or more application program as falling within the scope of a rule but anomalous when compared with other data items falling within the scope of the rule. The method of the present invention comprises determining a collection to which the data item belongs as defined by the rule. The collection that the data item belongs to is analyzed to calculate statistics regarding the other data items that are part of the collection. Based on the statistical calculations, it is determined whether the data item is an anomalous data item. If the data item is identified as an anomalous data item, it is flagged.