Patent Document ID: 7970772
Application ID: 11753232
Patent Status: 1

Claim One:
1. A method for monitoring abnormalities in a data stream, comprising the steps of: receiving a plurality of objects in the data stream; creating one or more clusters from the plurality of objects, each of the one or more clusters comprising one or more objects of the plurality of objects, wherein at least a subset of the one or more clusters are condensed into one or more cluster droplets, a given cluster droplet storing statistical data of each cluster within the given cluster droplet; determining from the statistical data whether each of the one or more clusters is abnormal when compared to a predefined value; and reporting at least one of the one or more clusters as an abnormal cluster of objects in the data stream; wherein the statistical data of each cluster within the given cluster droplet comprises: a number of pairwise attribute values; a number of categorical attribute values; a number of objects in the cluster; a total weight of the one or more objects in the cluster, wherein a weight of each of the one or more objects in the cluster is based at least in part on a fading function such that the weight of a given object substantially uniformly decreases over time; and a value indicative of when an object was most recently added to the cluster; and wherein the step of creating one or more clusters further comprises: computing one or more similarity values for a given object relating to one or more existing clusters; determining a closest cluster for the object based on the one or more similarity values; determining whether the similarity value for the object relating to the closest cluster is greater than a threshold; responsive to a determination that the similarity value is greater than the threshold, adding the object to the closest cluster and updating the statistical data of the closest cluster; responsive to a determination that the similarity value is not greater than the threshold, determining whether there is at least one inactive cluster; responsive to a determination that there is no inactive cluster, adding the object to the closest cluster and updating the statistical data of the closest cluster; and responsive to a determination that there is at least one inactive cluster, replacing one of the at least one inactive cluster with a new cluster comprising the object and generating statistical data of the new cluster.