Abstract: Embodiments of the invention provides systems and methods for automatically generating rules for detecting unauthorized network activities. The method comprises receiving network activity data for a set of prior network activities, deriving a set of field combinations by combining different fields in a subset of the plurality of fields of the network activity data, deriving a set of field value combinations associated with the field combination, calculating a field value combination signal-to-noise value (SNV) based on at least a ratio of authorized network activities to unauthorized network activities in the set of prior network activities, determining a field combination SNV based on the field value combination SNVs, selecting one or more field combinations to generate a set of one or more detection rules, and applying the selected detection rules to determine whether a particular network activity is authorized.