A method executable via operation of configured processing circuitry may include constructing a mutual information graph for categorical data with respect to observed attributes of a plurality of entities described in terms of respective ones of the observed attributes by the categorical data, determining a clique tree correlating attributes having at least a threshold level of mutual dependence among the observed attributes, and determining a normality rating for an entity relative to the plurality of entities based on the clique tree.