Abstract: Techniques for identifying a first process in a stream of event data. The techniques include accessing a stored signature for the first process, wherein the signature includes a plurality of features, and wherein the signature specifies a frequency and weight for each of the plurality of features; receiving a stream of event data having a plurality of events; selecting a window of event data that includes a subset of the plurality of events; calculating a first similarity between the signature for the first process and the event data within the window; and identifying the first process in the stream of event data when the first similarity is within a predetermined measure of similarity.