Abstract: A system and methods are provided for detecting an anomalous discrete data sequence. The method includes applying a mapping function to a set of discrete data sequences to generate a first support level indicating affinity between the mapping function and the data set, adding a new discrete data sequence to the data set, calculating a second support level indicating affinity of the mapping function and the data set including the new discrete data sequence, calculating a support gain from a difference between the second support level and the first support level, and determining from the support gain an anomaly score indicating that the new discrete data sequence is anomalous, and thereby providing an anomaly indication of the new discrete data sequence to a system for classifying events.