US Patent 9171158 Dynamic anomaly, association and clustering detection

Techniques are provided for dynamic anomaly, association and clustering detection. At least one code table is built for each attribute in a set of data containing one or more attributes. One or more clusters associated with one or more of the code tables are established. One or more new data points are received. A determination is made if a given one of the new data points is an anomaly. At least one of the one or more code tables is updated responsive to the determination. When a compression cost of a given one of the new data points is greater than a threshold compression cost for each of the one or more clusters, the given one of the new data points is an anomaly.