4. A method for alerting a user to abnormal micro-blog activity comprising: receiving a stream of micro-blog messages during a first time period; clustering the messages during a plurality of first clustering time intervals, each first clustering time interval having a duration that is less than the first time period, to produce a first plurality of first clustered text messages; in parallel with the clustering of the messages during a plurality of first clustering time intervals, clustering the first clustered text messages during a plurality of second clustering time intervals, each second clustering time interval having a duration that is less than the first time period and more than the first clustering time interval, to produce a second plurality of second clustered text messages; examining the received micro-blog messages for abnormal activity; and alerting a user when the abnormal activity is detected.
4. A method for alerting a user to abnormal micro-blog activity comprising: receiving a stream of micro-blog messages during a first time period; clustering the messages during a plurality of first clustering time intervals, each first clustering time interval having a duration that is less than the first time period, to produce a first plurality of first clustered text messages; in parallel with the clustering of the messages during a plurality of first clustering time intervals, clustering the first clustered text messages during a plurality of second clustering time intervals, each second clustering time interval having a duration that is less than the first time period and more than the first clustering time interval, to produce a second plurality of second clustered text messages; examining the received micro-blog messages for abnormal activity; and alerting a user when the abnormal activity is detected. 13. The method of claim 4 further comprising, in parallel with the clustering of the first clustered text messages during the plurality of first clustering time intervals, clustering the second clustered text messages during a plurality of third clustering time intervals, each third clustering time interval having a duration that is less than the first time period and more than the second clustering time interval, to produce a third plurality of third clustered text messages.