1. A computer implemented method of identifying events in a process, the method comprising: running, in a computer processor, a principal component analysis model on sensor data from the process; calculating, using the computer processor, statistics related to the model; determining, with the computer processor, if an event is occurring; finding, using the computer processor, a nearest cluster of bad actors related to the event to identify the event; differentiating, using the computer processor, a sensor that directly senses the event from a sensor that senses a residual of the event; storing the found nearest cluster of bad actors in a computer storage device; and further comprising for new bad actors: identifying a sequence of cluster matches; and correlating the sequence of cluster matches to known events; and further comprising: determining if a cluster needs to be split when new bad actors are added; and splitting the cluster into two clusters using a goodness of fit algorithm.