Activity clustering for anomaly detection. (1st January 2013)