1. A method for detecting an anomaly in real time series, comprising the steps of: determining a similarity matrix of nonnegative pairwise similarities between pairs of normal time series data; applying a spectral clustering procedure to the similarity matrix to partition variables representing dimensions of the time series data into groups, wherein the groups are mutually exclusive; estimating a model of normal behavior for each group; determining, for the real time series data, an anomaly score using the model of normal behavior for each group; and comparing the anomaly score to a predetermined threshold to signal the anomaly, wherein the steps are performed in a processor.