According to some embodiments, a system may be monitored to detect change events. A sequence associated with the detected change events may then be stored. The sequence may then be modified by deleting information associated with a detected change event. The sequence might also (or instead) be modified by adding information associated with a non-detected change event. Information associated with the normalized sequence may then be provided.