Patent Document ID: 20120158360
Application ID: 12971459
Patent Flag: 0

Claim One:
1. A deviation detection method for use with a processing system including at least one processor, the method comprising: (a) receiving at least one stream of event data at the processing system, the event data including at least one attribute; (b) updating, via the at least one processor, a long-term statistic corresponding to a first estimate of a probability density function (PDF) of at least one monitored attribute in the at least one stream of event data over a first time window; (c) updating, via the at least one processor, a short-term statistic corresponding to a second estimate of the PDF of the at least one monitored attribute in the at least one stream of event data over a second time window, the second time window being of a shorter duration than the first time window; (d) computing, via the at least one processor, first and second distances between an ideal density distribution and the long- and short-term statistics, respectively; (e) computing, via the at least one processor, a current deviation based at least in part on the first and second distances; (f) comparing the current deviation to a threshold value; and (g) repeating (a)-(f) as further monitored events are provided by the at least one stream of event data.