The current application is directed to monitoring subsystems, and monitoring methods incorporated within the monitoring subsystems, that monitor operation of devices and systems in order to identify normal states and to quickly determine when a device or system transitions from a normal state to an abnormal state. The methods and monitoring components to which the current application is directed employ self-organizing maps and moving-average self-organizing maps to both characterize normal system behavior and to identify transitions to abnormal system behaviors.