Network management using entropy-based signatures

Systems and methods are disclosed herein for generating a signature of an anomalous network event capable of adversely affecting the performance of a computing resource service provider. A signature computing workflow service receives network traffic information received at the computing resources service provider, and parses the network traffic information into a set of entries. The set of entries may include data for a set of parameters useable for communicating over a network. Entropy values may be calculated for the data and anomalies for the set of parameters may be detected based on changes in entropy for the set of parameters. A signature of an anomalous network traffic event may be generated based on characteristic entropy changes in the parameters associated with the anomalies. The signature may be useable to detect the presence of the network event.