US Patent 9218232 Anomaly detection methods, devices and systems

A method for detecting an anomaly in operation of a data analysis device, comprising: receiving present real-time readings of multiple sensors associated with the data analysis device, and maintaining a history of past real-time readings; determining which of said multiple sensors are correlated; computing a deviation between at least some of said present and at least some of said past real-time readings of said correlated sensors; and declaring an anomaly when said deviation exceeds a predetermined threshold.