1. A method, comprising the steps of: obtaining a graph stream; obtaining historical data of one or more nodes associated with the graph stream, wherein each node has associated with it a time-dependent label representative of activity of the node at a given time; extracting one or more features from the graph stream for one or more nodes; and creating one or more alarm levels for the one or more nodes based on the one or more extracted features and the historical data, wherein the step of creating one or more alarm levels comprises generating a regression model based on the one or more extracted features and the historical data and further wherein each of the one or more alarm levels is indicative of a probability of a change in a label class of an associated node in the graph stream; wherein the steps are performed by at least one processor device coupled to a memory.