A method, data processing system, and computer program product for identifying abnormalities in data. A model representing a plurality of modes for an activity generated from training data is retrieved. The training data includes a first plurality of measurements of a first performance of the activity over a period of time. Each of the plurality of modes is identified as one of normal and abnormal. Activity data including a second plurality of measurements of a second performance of the activity is received. A portion of the activity data is compared with the plurality of modes in the model. A notification of an abnormality in the second performance of the activity is generated in response to an identification that the portion of the activity data matches a mode in the plurality of modes identified as abnormal. Confirmation of the abnormality is requested via a user interface.