Abstract: A monitoring system (1) comprises an interface (2) for receiving source alerts from at least one detection engine, a database (7) of historical events; and a classifier (3) for classifying received source alerts by linking a source alert with an historical event or a current source alert to provide a link, and providing said link as an output alert. The classifier comprises match methods (9) for processing source alerts and generating a score for extent of matching of a source alert with an historical event or current source alert, a voting engine (4) for weighting scores from the match methods (9), and a linking function (6) for determining that there is a link if a combination of the weighted outputs of a plurality of match methods exceeds a threshold. At least some match methods (9) are each associated with a specific field of a source alert such as a numerical value field or a name field of a source alert.

Abstract: A system (1) has an analysis engine (2) for analyzing transaction data (20) received in real time at an interface (3). A context generation engine—(25) directly receives transaction data (20) from the interface (3) and also macro data (26). Queue listeners (52) pull data from a shared memory queue (50(a), 50(b)) and feed it to transaction processors (53), which call a dynamic procedure (43) of the context generation engine (25) in real time. The transaction processors (53) therefore feeds transaction data and context parameters to a rule processor (61), effectively customizing the rule processor in real time. Each rule processor (61) executes a decision tree to determine the rules to execute in real time.