Abstract: The present invention extends to methods, systems, and computer program products for detecting, classifying, and tracking abnormal data in a data stream. Embodiments include an integrated set of algorithms that enable an analyst to detect, characterize, and track abnormalities in real-time data streams based upon historical data labeled as predominantly normal or abnormal. Embodiments of the invention can detect, identify relevant historical contextual similarity, and fuse unexpected and unknown abnormal signatures with other possibly related sensor and source information. The number, size, and connections of the neural networks all automatically adapted to the data. Further, adaption appropriately and automatically integrates unknown and known abnormal signature training within one neural network architecture solution automatically. Algorithms and neural networks architecture are data driven, resulting more affordable processing.