A system and method for identifying changes in a state or activity is described. A real-time event monitoring application, implemented in a hardware processor, computes features over varying sampling periods, which are stored in cascading buffers. The various sampling periods enable determination of trends of a computed feature, comparison of the trends of the computed feature with trends of other features, normalization of the computed feature based on the same or different features at the same or different time scales, scaling of the normalized computed feature relative to other features at the same or different time scale, and identification of a change in state or activity based on a scaled normalized computed feature.