1. A method comprising: receiving a first stream of events; for each event in the received first stream of events, determining whether the event has a probability equal to or greater than a predetermined threshold of being associated with one of a plurality of classifications in accordance with a generalized linear model comprising a predetermined distribution function, a linear predictor, and a predetermined link function; for each event determined to have a probability equal to or greater than the predetermined threshold of being associated with one of the plurality of classifications, placing the event in an output stream along with a mark indicating the associated classification; for each event determined to not have a probability equal to or greater than the predetermined threshold of being associated with one of the plurality of classifications, placing the event in an output stream along with a mark indicating that the event is not associated with one of the plurality of classifications; receiving a second stream of events, each event in the second stream having been previously processed and marked as associated with one of the plurality of classifications; and based on events in the second stream, estimating unknown parameters in the linear predictor used in determining whether events in the first stream have a probability equal to or greater than a predetermined threshold of being associated with one of the plurality of classifications.