Abstract: A method and apparatus wherein the method includes detecting a plurality of events within a security system, evaluating the events using one of a first expression defined by ?r?Qconƒ(ƒ(r)?mrg(r)), a second expression defined by ?r?R|ƒ(r)?mrg(r)|dr and a third expression defined by ?r?Rconƒ(ƒ(r)?mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances, comparing a value of the evaluated expression with a threshold value and setting an alarm upon detecting that the value exceeds the threshold value.