Abstract: According to one embodiment, in response to a set of data for anomaly detection, a Bayesian belief network (BBN) model is applied to the data set, including for each of a plurality of features of the BBN model, performing an estimate using known observed values associated with remaining features to generate a posterior probability for the corresponding feature. A scoring operation is performed using a predetermined scoring algorithm on posterior probabilities of all of the features to generate a similarity score, wherein the similarity score represents a degree to which a given event represented by the data set is novel relative to historical events represented by the BBN model.