Systems and methods for determining critical thresholds on a number of events (k) and a window length (t) for properly defining a burst of events in a data stream. A new coverage metric Ck,t is defined and used in the determination, where the coverage metric Ck,t is defined for a particular pair (k,t) as a fraction, with the numerator defined a number of events that occur within some (k,t)-bursty window and the denominator defined as the total number of events (n) that occurred along the entire time span being analyzed. Coverage metric Ck,t is monotonic non-increasing in k and monotonic non-decreasing in t, allowing for a divide-and-conquer search strategy to be used to find the critical threshold pairs (k*, t*).