1. A method, comprising the steps of: obtaining a graph stream; obtaining historical data of one or more nodes associated with the graph stream; extracting one or more features from the graph stream for one or more nodes; and creating one or more alarm levels for the one or more nodes based on the one or more extracted features and the historical data; wherein the steps are performed by at least one processor device coupled to a memory.