Patent ID: 7620533

Claim:
A method of detecting a target event based on a data stream, the data stream representing events accessed with a computerized monitoring system, the method being implemented on a computer or a network of computers having a memory and one or more processors, the method comprising: maintaining a short term distribution that models the data stream in the memory, wherein the short term distribution is updated when input data is received; maintaining a long term distribution that models the data stream in the memory, wherein the long term distribution is updated when the input data is received; determining a distribution difference with the one or more processors, the distribution difference being based on a difference between the short term distribution and the long term distribution; applying a statistical measure to the distribution difference with the one or more processors, the statistical measure comprising both an average of the distribution difference and an average difference between the distribution difference and the average of the distribution difference; and generating an alert when the measure of the difference exceeds a threshold using one or more of the processors, the alert indicating an occurrence of a target event to a person or a machine, wherein when the alert is generated the short term distribution in the memory is returned to a state just before it was updated to include an input that caused the alert, and the long term distribution is returned to a state just before the long term distribution was updated to include the input that caused the alert.