A computer-implemented method for detecting anomalies in an incoming data stream comprising: receiving a data stream that comprises values of metrics derived from observations of operation of a computing entity over a time window; forming a model comprising variances of the data over the time window, the model identifying operating thresholds for each metric based on the variances of the data for each metric in the data stream; accessing a value of a metric vector for each metric from the incoming data stream; comparing the value of the metric vector for each metric with operating thresholds of the corresponding metric from the model; assigning a first matrix point value in response to the value of the metric vector being within the operating thresholds or a second matrix point value in response to the value of the metric vector being outside the operating thresholds; forming an anomalous pattern matrix based on the first or second matrix point value of each metric from the incoming data stream; using the model to compute a steady state distance of the incoming data stream, by calculating the steady state distance between the anomalous pattern matrix and a steady state matrix, the steady state matrix representing a non-anomalous state; determining that the steady state distance exceeds a steady state threshold that is determined based on the operating thresholds of the model and metric vectors of the incoming data stream; in response to the steady state distance exceeding the steady state threshold, computing a Hamming distance between the anomalous pattern matrix and a metric matrix of metric vectors from the incoming data stream; detecting an anomaly in the incoming data stream based on the Hamming distance; and generating, at a computer, an alert indicating the anomaly. receiving a data stream that comprises values of metrics derived from observations of operation of a computing entity over a time window; forming a model comprising variances of the data over the time window, the model identifying operating thresholds for each metric based on the variances of the data for each metric in the data stream; accessing a value of a metric vector for each metric from the incoming data stream; comparing the value of the metric vector for each metric with operating thresholds of the corresponding metric from the model; assigning a first matrix point value in response to the value of the metric vector being within the operating thresholds or a second matrix point value in response to the value of the metric vector being outside the operating thresholds; forming an anomalous pattern matrix based on the first or second matrix point value of each metric from the incoming data stream; using the model to compute a steady state distance of the incoming data stream, by calculating the steady state distance between the anomalous pattern matrix and a steady state matrix, the steady state matrix representing a non-anomalous state; determining that the steady state distance exceeds a steady state threshold that is determined based on the operating thresholds of the model and metric vectors of the incoming data stream; in response to the steady state distance exceeding the steady state threshold, computing a Hamming distance between the anomalous pattern matrix and a metric matrix of metric vectors from the incoming data stream; detecting an anomaly in the incoming data stream based on the Hamming distance; and generating, at a computer, an alert indicating the anomaly.