Patent ID: 8230272

Claim:
A method performed by a computer system, the method comprising: determining if an anomaly occurs in a data stream, by: a. receiving a data element included in the first data stream; b. determining a pattern for the received data element; c. incrementing an occurrence count for a pattern stored in a pattern analysis storage, if the determined pattern for the received data element matches the stored pattern; d. repeating a-c for other data elements in the first data stream; e. determining a mean occurrence count value based on the sum of the occurrence counts of all of the patterns stored in the pattern analysis storage divided by the total number of patterns stored in the pattern analysis storage; f. retrieving an occurrence count for a first stored pattern in the pattern analysis storage; g. identifying the pattern as an anomaly, if the retrieved occurrence count is below the determined mean occurrence count value multiplied by a percentage threshold value; h. repeating f and g for other patterns stored in the pattern analysis storage; and i. outputting an anomaly identifier if the pattern was identified as an anomaly.