Abstract: Apparatus for classifying network traffic events in accordance with one or more conditions includes a categorizer for categorizing a plurality of network traffic events, an analyzer for analyzing at least one aspect of the network traffic events and identifying groups in accordance with the analysis; a structure for determining group allocation for the categorized network traffic events, a generator for generating one or more conditions in relation to the group and category of analyzed network traffic events, and a classifier for classifying a newly detected network traffic event in accordance with the one or more conditions generated.