3. A method for alerting a user to abnormal micro-blog activity comprising: collecting a plurality of tokenized, received micro-blog messages in a first time interval; selecting a plurality of seed tokens; forming a plurality of soft clusters of micro-blog messages in which all the messages in a soft cluster have the same seed token, each of the soft clusters has a different seed token, and some of the messages are in more than one soft cluster; reducing the number of soft clusters by eliminating some soft clusters that are less dense than other soft clusters; eliminating duplication of messages so that each text message is found in only one soft cluster; agglomeratively merging the soft clusters to produce a first output of clustered text messages; examining the received micro-blog messages for abnormal activity; and alerting a user when the abnormal activity is detected.
3. A method for alerting a user to abnormal micro-blog activity comprising: collecting a plurality of tokenized, received micro-blog messages in a first time interval; selecting a plurality of seed tokens; forming a plurality of soft clusters of micro-blog messages in which all the messages in a soft cluster have the same seed token, each of the soft clusters has a different seed token, and some of the messages are in more than one soft cluster; reducing the number of soft clusters by eliminating some soft clusters that are less dense than other soft clusters; eliminating duplication of messages so that each text message is found in only one soft cluster; agglomeratively merging the soft clusters to produce a first output of clustered text messages; examining the received micro-blog messages for abnormal activity; and alerting a user when the abnormal activity is detected. 12. The method of claim 3 wherein the step of examining received micro-blog messages for abnormal activity is performed on a computer system.