8. The method of claim 1 , wherein the first ranked list is determined from the first table.
1. A method comprising: monitoring entity instances during a first interval, each entity instance being one of a plurality of types of entity instances; determining from the entity instances monitored during the first interval a first ranked list of entity instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the first interval, the first ranked list having a first cardinality of types of entity instances; monitoring entity instances during a second interval, each entity instance being one of the plurality of types of entity instances; determining from the entity instances monitored during the second interval a second ranked list of entity instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the second interval, the second ranked list having the first cardinality of types of entity instances; and merging the first ranked list and the second ranked list into a third ranked list of entities instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the first interval and the second interval; wherein monitoring entity instances during a first interval comprises: entering monitored entity instances in a first table until the first table has the first cardinality of entries; entering monitored entity instances in a second table after the first table has the first cardinality of entries; determining if an entity instance in the second table has a greater count than an entity instance in the first table; and swapping the entity instance in the second table with the entity instance in the first table if the entity instance in the second table has a greater count than the entity instance in the first table.