A method executable via operation of configured processing circuitry may include constructing a mutual information graph for categorical data with respect to observed attributes of a plurality of entities described in terms of respective ones of the observed attributes by the categorical data, determining a clique tree correlating attributes having at least a threshold level of mutual dependence among the observed attributes, and determining a normality rating for an entity relative to the plurality of entities based on the clique tree.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. An apparatus comprising processing circuitry configured to execute instructions that, when executed, cause the apparatus to: construct a mutual information graph for categorical data with respect to observed attributes of a plurality of entities described in terms of respective ones of the observed attributes by the categorical data; determine a clique tree correlating attributes having at least a threshold level of mutual dependence among the observed attributes; and determine a normality rating for an entity relative to the plurality of entities based on the clique tree. 2. The apparatus of claim 1, wherein the categorical data is high dimensional data, and wherein determining the normality rating comprises determining a joint probability distribution to determine a probability of the entity based on lower dimension subsets of the observed attributes. 3. The apparatus of claim 2, wherein the entity is described by a combination of attributes, and the combination of attributes has not been previously observed. 4. The apparatus of claim 2, wherein determining the joint probability distribution comprises determining a ratio of probabilities of cliques defined by common attribute groupings to probabilities of overlapping elements from the cliques. 5. The apparatus of claim 1, wherein the plurality of entities are each associated with a particular classification of entities, and wherein the normality rating defines a degree to which the entity fits within the particular classification. 6. The apparatus of claim 1, wherein determining the clique tree comprises enabling a user to adjust the mutual information graph. 7. The apparatus of claim 1, wherein the processing circuitry is further configured to automatically determine the threshold level by partitioning the categorical data randomly into a training data set and a test data set, and optimizing the threshold level by maximizing a product of probabilities of the training data set and the test data set. 8. The apparatus of claim 1, wherein the processing circuitry is further configured to generate an output to a user terminal, the output indicating whether the entity is an anomaly, a classification of the entity, or an index of data to which the entity is similar. 9. The apparatus of claim 8, wherein the output comprises an alarm, an alert, or an instruction to take an action relative to the entity. 10. A method executable via operation of configured processing circuitry, the method comprising: constructing a mutual information graph for categorical data with respect to observed attributes of a plurality of entities described in terms of respective ones of the observed attributes by the categorical data; determining a clique tree correlating attributes having at least a threshold level of mutual dependence among the observed attributes; and determining a normality rating for an entity relative to the plurality of entities based on the clique tree. 11. The method of claim 10, wherein the categorical data is high dimensional data, and wherein determining the normality rating comprises determining a joint probability distribution to determine a probability of the entity based on lower dimension subsets of the observed attributes. 12. The method of claim 11, wherein the entity is described by a combination of attributes, and the combination of attributes has not been previously observed. 13. The method of claim 11, wherein determining the joint probability distribution comprises determining a ratio of probabilities of cliques defined by common attribute groupings to probabilities of overlapping elements from the cliques. 14. The method of claim 10, wherein the plurality of entities are each associated with a particular classification of entities, and wherein the normality rating defines a degree to which the entity fits within the particular classification. 15. The method of claim 10, wherein determining the clique tree comprises enabling a user to adjust the mutual information graph. 16. The method of claim 10, further comprising automatically determining the threshold level by partitioning the categorical data randomly into a training data set and a test data set, and optimizing the threshold level by maximizing a product of probabilities of the training data set and the test data set. 17. The method of claim 10, further comprising generating an output to a user terminal, the output indicating whether the entity is an anomaly, a classification of the entity, or an index of data to which the entity is similar. 18. The method of claim 17, wherein the output comprises an alarm, an alert, or an instruction to take an action relative to the entity. 19. A method executable via operation of configured processing circuitry, the method comprising: utilizing a correlation metric with respect to observed attributes of a plurality of entities described in terms of respective ones of the observed attributes in categorical data; determining a clique tree defining entity groupings with correlated attributes based on the correlation metric; and determining a normality rating for an entity relative to the plurality of entities based on the clique tree. 20. The method of claim 19, wherein utilizing the correlation metric comprises constructing a mutual information graph with respect to observed attributes of the plurality of entities, and wherein determining the clique tree comprises determining the clique tree by correlating attributes having at least a threshold level of mutual dependence.