1. A method performed by a computer system for determining if an anomaly occurs in a data stream, the method comprising: a. receiving a data element included in the data stream; b. determining a pattern for the received data element; c. incrementing an occurrence count for a pattern stored in a pattern analysis storage, if the determined pattern for the received data element matches the stored pattern; d. repeating a-c for other data elements in the data stream; e. retrieving an occurrence count for a first stored pattern in the pattern analysis storage; f. identifying the pattern as an anomaly, if the retrieved occurrence count is below a previously defined count threshold; g. repeating e and f for other patterns stored in the pattern analysis storage; and h. outputting an anomaly identifier if the pattern was identified as an anomaly.