Abstract: A method includes a computing device receiving data traffic flow and initializing a subroutine to assess alerts for the received data traffic flow; the computer device determining a collection of rules which produce more than a threshold of false positive alerts and more than a threshold of true positive alerts for the assessed alerts; the computer device determining a logical condition and an atomic rule element to add to the collection of rules; and the computer device implementing the added logical condition and atomic rule element if the number of assessed alerts are decreased below a value.