The present invention extends to methods, systems, and
computer program products for detecting, classifying, and tracking abnormal data in a
data stream. Embodiments include an integrated set of algorithms that enable an analyst to detect, characterize, and track abnormalities in real-
time data streams based upon historical data labeled as predominantly normal or abnormal. Embodiments of the invention can detect, identify relevant historical
contextual similarity, and fuse unexpected and unknown abnormal signatures with other possibly related sensor and source information. The number, size, and connections of the neural networks all automatically adapted to the data. Further, adaption appropriately and automatically integrates unknown and known abnormal signature training within one
neural network architecture solution automatically. Algorithms and neural networks architecture are
data driven, resulting more affordable
processing. Expert knowledge can be incorporated to enhance the process, but sufficient performance is achievable without any
system domain or neural networks expertise.