1. A non-transitory program storage device is provided readable by machine, tangibly embodying a program of instructions automatically executable by the machine to perform a method for determining a cluster, the method comprising: receiving input data on occurrences of a phenomenon at locations and times and data on characteristics of the locations and times; determining actual occurrences of the phenomenon at the three-dimensional space-time points according to the input data; determining expected occurrences using a domain dependent model for the phenomenon, wherein the expected occurrences are a random sampling of the data on characteristics of the locations and times; searching the expected occurrences for a first plurality of candidate solutions and the actual occurrences for a second plurality of candidate solutions; determining a strength of each of the first and second plurality of candidate solutions; selecting a convex container shape from the second plurality of candidate solutions having a strength unlikely to exist in the expected occurrences for determining a cluster in the input data; and determining a solution represented as a set of points that conforms to a volume of the selected convex container shape for a cluster.