Certain example embodiments relate to techniques for detecting anomalies in streaming data. More particularly, certain example embodiments use an approach that combines both unsupervised and supervised machine learning techniques to create a shared anomaly detection model in connection with a modified k-means clustering algorithm and advantageously also enables concept drift to be taken into account. The number of clusters k need not be known in advance, and it may vary over time. Models are continually trainable as a result of the dynamic reception of data over an unknown and potentially indefinite time period, and clusters can be built incrementally and in connection with an updatable distance threshold that indicates when a new cluster is to be created. Distance thresholds also are dynamic and adjustable over time.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A system for detecting anomalies in data dynamically received from a plurality of sensors associated with one or more machines, the system comprising: a knowledgebase; a model store; one or more interfaces configured to receive data from the plurality of sensors; and processing resources including at least one processor and a memory, the processing resources being configured, for each instance of data received via the one or more interfaces, to at least: classify, using a model retrieved from the model store, the respective instance as being one of a normal instance type and an anomalous instance type, the retrieved model being selected from the model store as being appropriate for the machine that produced the data in the respective instance if such a model exists in the model store; in response to a classification of the respective instance being a normal instance type, use the data in the respective instance to train the retrieved model; in response to a classification of the respective instance being an anomalous instance type that is not new, determine from the knowledgebase an action to be taken and take the determined action; and in response to a classification of the respective instance being an anomalous instance type that is new, seek confirmation from an authorized user as to whether the respective instance should be designated as a confirmed new anomalous instance type, and: responsive to confirmation from the authorized user that the respective instance is a new anomalous instance type, update the knowledgebase with information about the respective instance and/or an action to be taken should the new anomalous instance type be detected again; and use the data in the respective instance to train the retrieved model; wherein each model in the model store is implemented using a k-means cluster algorithm modified so as to (a) be continually trainable as a result of the dynamic reception of data over an unknown and potentially indefinite time period, and (b) build clusters incrementally and in connection with an updatable distance threshold that indicates when a new cluster is to be created; and wherein each said model has a respective total number of clusters that is dynamic and learned over time. 2. The system of claim 1, wherein the distance threshold is updatable based on the variability and distribution of the received data. 3. The system of claim 1, wherein the each said model has a respective total number of clusters that is not preset by an authorized user or programmer of the system. 4. The system of claim 1, wherein instances are assigned to clusters exactly one time. 5. The system of claim 1, wherein centroid calculations for clusters in each said model use a weighted mean of the assigned cluster instances that are received over time, at least after an initial training period. 6. The system of claim 5, wherein centroid distance calculations implement Mahalanobis distance measurement. 7. The system of claim 1, wherein the model store is configured to store one model for each machine from which data is receivable. 8. The system of claim 1, wherein the one or more interfaces connect to a messaging bus that receives data from the sensors as events. 9. The system of claim 8, further comprising a complex event processing (CEP) engine, the processing resources being further configured to at least receive and normalize data received via the one or more interfaces using the CEP engine. 10. The system of claim 1, wherein the model store is implemented in an in-memory data grid. 11. The system of claim 1, wherein plural normal instance type and plural anomalous instance types are definable. 12. The system of claim 11, further comprising a complex event processing (CEP) engine, the processing resources being further configured to at least perform the classification using the CEP engine. 13. The system of claim 1, wherein: a given data stream X from a given one of the machines includes instances x1 . . . xn with a number of variables d; the modified k-means cluster algorithm uses a cluster initialization window p, a distance threshold t, an instance-weighting window w, a number of clusters k, clusters c1 . . . cn, sample covariance matrices S1 . . . Sk for respective clusters, and μ1 . . . μk as centroids of respective clusters; and the modified k-means algorithm is programmed to: initialize centroid μ1 of cluster c1 as the mean of instances x1 . . . xp, and matrix S1 as the covariance of instances x1 . . . xp, cluster c1 and instances x1 . . . xp being predicted as normal instance types; and for each instance i from xp+1 . . . x∞ in the given data stream X: temporarily assign instance xi to the cluster with the nearest centroid μ1 . . . μk; if the distance of xi to that centroid is greater than the distance threshold t, obtain a cluster assignment for xi from an or the authorized user; and if the cluster assignment is for a confirmed new anomalous instance type, (a) create a new cluster cj+1, and set centroid μj+1=xi and covariance matrix Sj+1 as the mean of existing covariance matrices S1 . . . Sj, and (b) predict the class of cj+1 for xi; and otherwise: update the centroid μj as the w window-weighted mean of the instances xi that have been assigned to the cluster; if the number of instances xi that have been assigned to the cluster is greater than the cluster initialization window p, update the matrix Sj as the w window-weighted covariance of the instances xi that have been assigned to the cluster; and predict the class of cj for xi. 14. The system of claim 13, wherein the modified k-means algorithm is further programmed to return clusters c1 . . . ck and centroids μ1 . . . μk upon request. 15. The system of claim 13, wherein the modified k-means algorithm is further programmed such that: while n≦w, perform calculations such that: μ n = ( n - 1 )  μ n - 1 + x n n   and S n = ( n - 1 )  ( S n - 1 + μ n - 1 T  μ n - 1 ) + x n T  x n n - μ n T  μ n ; while n≧w, perform calculations such that: μ n = ( w - 1 )  μ n - 1 + x n w   and S n = ( w - 1 )  ( S n - 1 + μ n - 1 T  μ n - 1 ) + x n T  x n w - μ n T  μ n . 16. The system of claim 13, wherein the instance-weighting window w is equal to the mean time between failures divided by the product of a constant and the sampling interval T. 17. A system for detecting anomalies in data dynamically received from a plurality of sensors, each said sensor being associated with one or more machines, the system comprising: a model store, each said machine having an associated model stored therein; one or more interfaces configured to receive data from the plurality of sensors; and processing resources including at least one processor and a memory, the processing resources being configured to train each said model using a modified k-means cluster algorithm in which there are defined a cluster initialization window p, a distance threshold t, an instance-weighting window w, a number of clusters k, clusters c1 . . . cn, sample covariance matrices S1 . . . Sk for respective clusters, and μ1 . . . μk as centroids of respective clusters; wherein each said cluster has an associated class, the class being one of an anomalous type class and a non-anomalous type class; wherein, for each given data stream X from a given one of the machines that includes data instances x1 . . . xn with a number of variables d, the modified k-means algorithm is programmed to: initialize centroid μ1 of cluster c1 as the mean of instances x1 . . . xp, and matrix S1 as the covariance of instances x1 . . . xp, cluster c1 and instances x1 . . . xp being predicted as normal instance types; and for each instance i from xp+1 . . . x∞ in the given data stream X: temporarily assign instance xi to the cluster with the nearest centroid μ1 . . . μk; if the distance of xi to that centroid is greater than the distance threshold t, obtain a cluster assignment for xi from an authorized user; and if the cluster assignment is for a confirmed new anomalous instance type, (a) create a new cluster cj+1, and set centroid μj+1=xi and covariance matrix Sj+1 as the mean of existing covariance matrices S1 . . . Sj, and (b) predict the class of cj+1 for xi; and otherwise: update the centroid μj as the w window-weighted mean of the instances xi that have been assigned to the cluster; if the number of instances xi that have been assigned to the cluster is greater than the cluster initialization window p, update the matrix Sj as the w window-weighted covariance of the instances xi that have been assigned to the cluster; and predict the class of cj for xi. 18. The system of claim 17, wherein the modified k-means algorithm is further programmed to return clusters c1 . . . ck and centroids μ1 . . . μk upon request. 19. The system of claim 17, wherein the modified k-means algorithm is further programmed such that: while n≦w, perform calculations such that: μ n = ( n - 1 )  μ n - 1 + x n n   and S n = ( n - 1 )  ( S n - 1 + μ n - 1 T  μ n - 1 ) + x n T  x n n - μ n T  μ n ; while n>w, perform calculations such that: μ n = ( w - 1 )  μ n - 1 + x n w   and S n = ( w - 1 )  ( S n - 1 + μ n - 1 T  μ n - 1 ) + x n T  x n w - μ n T  μ n . 20. The system of claim 17, wherein the instance-weighting window w is equal to the mean time between failures divided by the product of a constant and the sampling interval T. 21. The system of claim 20, wherein the constant is 600 and the cluster initialization window p is 30. 22. The system of claim 17, wherein the distance threshold t is updatable based on the variability and distribution of the received data. 23. The system of claim 22, wherein the distance threshold t is determined using a chi-square cumulative distribution commensurate with a defined false error rate and with a number of degrees of freedom equal to the number of variables in the given data stream X. 24. The system of claim 17, wherein the number of clusters k is adjustable over time. 25. The system of claim 17, wherein vector μ and covariance matrix S are incrementally updated via Mahalanobis distance calculations. 26. The system of claim 17, wherein the processing resources are further configured to cooperate with a workflow management system to at least issue alerts in response to anomalous class types being predicted. 27. The system of claim 17, wherein plural normal instance type and plural anomalous instance types are definable. 28. A method of detecting anomalies in data dynamically received from a plurality of sensors associated with one or more machines, the method comprising: receiving, via one or more computer mediated interfaces, data from the plurality of sensors; and for each instance of data received via the one or more interfaces, using processing resources including at least one processor and a memory, to at least: classify, using a model retrieved from a model store, the respective instance as being one of a normal instance type and an anomalous instance type, the retrieved model being selected from the model store as being appropriate for the machine that produced the data in the respective instance if such a model exists in the model store; in response to a classification of the respective instance being a normal instance type, use the data in the respective instance to train the retrieved model; in response to a classification of the respective instance being an anomalous instance type that is not new, determine an action to be taken and take the determined action; and in response to a classification of the respective instance being an anomalous instance type that is new, seek confirmation from an authorized user as to whether the respective instance should be designated as a confirmed new anomalous instance type, and: responsive to confirmation from the authorized user that the respective instance is a new anomalous instance type, update a knowledgebase with information about the respective instance and/or an action to be taken should the new anomalous instance type be detected again; and use the data in the respective instance to train the retrieved model; wherein each model in the model store is implemented using a k-means cluster algorithm modified so as to (a) be continually trainable as a result of the dynamic reception of data over an unknown and potentially indefinite time period, and (b) build clusters incrementally and in connection with an updatable distance threshold that indicates when a new cluster is to be created; and wherein each said model has a respective total number of clusters that is dynamic and learned over time. 29. The method of claim 28, further comprising updating the distance threshold based on the variability and distribution of the received data. 30. The method of claim 28, wherein: a given data stream X from a given one of the machines includes instances x1 . . . xn with a number of variables d; the modified k-means cluster algorithm uses a cluster initialization window p, a distance threshold t, an instance-weighting window w, a number of clusters k, clusters c1 . . . cn, sample covariance matrices S1 . . . Sk for respective clusters, and μ1 . . . μk as centroids of respective clusters; and the modified k-means algorithm is programmed to: initialize centroid μ1 of cluster c1 as the mean of instances x1 . . . xp, and matrix S1 as the covariance of instances x1 . . . xp, cluster c1 and instances x1 . . . xp being predicted as normal instance types; and for each instance i from x1+1 . . . x∞ in the given data stream X: temporarily assign instance xi to the cluster with the nearest centroid μ1 . . . μk; if the distance of xi to that centroid is greater than the distance threshold t, obtain a cluster assignment for xi from an authorized user; and if the cluster assignment is for a confirmed new anomalous instance type, (a) create a new cluster cj+1, and set centroid μj+1=xi and covariance matrix Sj+1 as the mean of existing covariance matrices S1 . . . Sj, and (b) predict the class of cj+1 for xi; and otherwise: update the centroid μj as the w window-weighted mean of the instances xi that have been assigned to the cluster; if the number of instances xi that have been assigned to the cluster is greater than the cluster initialization window p, update the matrix Sj as the w window-weighted covariance of the instances xi that have been assigned to the cluster; and predict the class of cj for xi. 31. A method of detecting anomalies in data dynamically received from a plurality of sensors, each said sensor being associated with one or more machines, the method comprising: maintaining a model store, each said machine having an associated model stored therein; receiving, via one or more interfaces, data from the plurality of sensors; and using processing resources including at least one processor and a memory to train each said model using a modified k-means cluster algorithm in which there are defined a cluster initialization window p, a distance threshold t, an instance-weighting window w, a number of clusters k, clusters c1 . . . cn, sample covariance matrices S1 . . . Sk for respective clusters, and μ1 . . . μk as centroids of respective clusters; wherein each said cluster has an associated class, the class being one of an anomalous type class and a non-anomalous type class; wherein, for each given data stream X from a given one of the machines that includes data instances x1 . . . xn with a number of variables d, the modified k-means algorithm is programmed to: initialize centroid μ1 of cluster c1 as the mean of instances x1 . . . xp, and matrix S1 as the covariance of instances x1 . . . xp, cluster c1 and instances x1 . . . xp being predicted as normal instance types; and for each instance i from xp+1 . . . x∞ in the given data stream X: temporarily assign instance xi to the cluster with the nearest centroid μ1 . . . μk; if the distance of xi to that centroid is greater than the distance threshold t, obtain a cluster assignment for xi from an authorized user; and if the cluster assignment is for a confirmed new anomalous instance type, (a) create a new cluster cj+1, and set centroid μj+1=xi and covariance matrix Sj+1 as the mean of existing covariance matrices S1 . . . Sj, and (b) predict the class of cj+1 for xi; and otherwise: update the centroid μj as the w window-weighted mean of the instances xi that have been assigned to the cluster; if the number of instances xi that have been assigned to the cluster is greater than the cluster initialization window p, update the matrix Sj as the w window-weighted covariance of the instances xi that have been assigned to the cluster; and predict the class of cj for xi. 32. The method of claim 31, wherein the modified k-means algorithm is further programmed to return clusters c1 . . . ck and centroids upon request. 33. The method of claim 31, wherein the modified k-means algorithm is further programmed such that: while n≦w, perform calculations such that: μ n = ( n - 1 )  μ n - 1 + x n n   and S n = ( n - 1 )  ( S n - 1 + μ n - 1 T  μ n - 1 ) + x n T  x n n - μ n T  μ n ; while n>w, perform calculations such that: μ n = ( w - 1 )  μ n - 1 + x n w   and S n = ( w - 1 )  ( S n - 1 + μ n - 1 T  μ n - 1 ) + x n T  x n w - μ n T  μ n . 34. The method of claim 31, wherein the instance-weighting window w is equal to the mean time between failures divided by the product of a constant and the sampling interval T. 35. The method of claim 31, wherein the distance threshold t is determined using a chi-square cumulative distribution commensurate with a defined false error rate and with a number of degrees of freedom equal to the number of variables in the given data stream X. 36. The method of claim 31, wherein the number of clusters k is adjustable over time. 37. The method of claim 31, wherein the processing resources are further configured to cooperate with a workflow management system to at least issue alerts in response to anomalous class types being predicted. 38. A non-transitory computer readable storage medium comprising instructions that, when executed, perform the method of claim 28. 39. A non-transitory computer readable storage medium comprising instructions that, when executed, perform the method of claim 31.