ported from Fluent::ChangeFinder ( https://github.com/muddydixon/fluent-plugin-anomalydetect/blob/master/lib/fluent/plugin/change_finder.rb )