Abstract: In analyzing real-time order data, a surveillance system obtains historical orders data in a historical order stream labeled for a given rule, and for the given rule, determines optimal time and optimal data volume using a distribution model for the historical orders data. The surveillance system obtains real-time orders data from a real-time order stream within the optimal time or optimal data volume, determines that at least one real-time orders data violates the given rule, and validates that the real-time orders data indicates fraudulent activity. The surveillance system determines that the real-time orders data does not conform to the distribution model for the given rule, and in response, updates the distribution model using the real-time orders data, and updates the determination of the optimal time and optimal data volume using the updated distribution model and associating the updated optimal time and the updated optimal data volume with the given rule.