Abstract: A genetic algorithm (GA) in combination with a random decision forest can be used to identify a feature subset related to an observed incident. The GA is used to select feature subsets for which data samples are obtained to train and test random decision forests per individual feature subset (“individual”) with respect to an observed incident. For each generation of a GA run, fitness values of the individuals are determined based on the testing of the corresponding random decision forest. At termination of the GA run, an individual representing a feature subset is identified as likely most related to the observed incident. The trained random decision forest corresponding to the individual or a subset of the trained random decision forest is used to predict or classify whether live values of the fittest feature subset indicate the observed incident.