In some embodiments, a method receives a first instance of data for anomaly detection. The first instance of data includes values from multiple variables. The first instance of data is stored in a queue. The method weights instances of data in the queue based on data changing over time and projects the instances of the data in the queue into a space. A point in the space represents a correlation of the values for the multiple variables for a respective instance of data. A boundary is generated based on the points in the space. Then, the method determines a point in the space that is considered an anomaly based on the boundary.