Patent ID: 8005771

Claim:
A method for detecting a change from a normal state in a multivariate data stream, the method comprising the steps of: (A) receiving a multidimensional training data stream including a plurality of data points representing a normal state; (B) sampling a plurality of m segment windows in the training data stream, each segment window representing a predefined time interval in the data stream; (C) for each of said plurality of segment windows, summarizing a distribution of data points in the segment window by constructing a training histogram h; (D) representing each training histogram h i by a set of distribution representatives r i using clustering; (E) receiving a test data stream including a plurality of multidimensional data points; (F) sampling data points in a plurality of segment windows in the test data stream, each segment window representing a predefined time interval in the data stream; (G) for each segment window in the test data, summarizing a distribution of data points in the segment window by constructing a test histogram h′; (H) representing each test histogram h′ by a set of distribution representatives r′ using clustering; (I) comparing test histograms h′ with training histograms h i using the distribution representatives to find closest matches using a similarity measure S; and (J) transmitting an indication that the multivariate data stream contains a change from the normal state for those segments having a similarity measure S indicating a similarity lower than a decision threshold σ.