1. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, the storage medium comprising stored instructions configured to cause a data processing apparatus to perform operations including: accessing distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables, wherein a transactional event is represented by data corresponding to a variable, wherein the distributional data is organized with respect to multi-dimensional subspaces of the sample space, wherein: a transactional event is associated with a subspace based on one or more representative observations; the distributional data specifies a number of the transactional events associated with each of the subspaces; the transactional events include multiple unauthorized transactions and multiple authorized transactions; and the distributional data further specifies, with respect to each of the subspaces, a percentage of the transactional events that are unauthorized transactions; analyzing multiple candidate subspaces among the multi-dimensional subspaces of the sample space, wherein analyzing each of the candidate subspaces includes identifying a best one of the candidate subspaces, wherein the percentage specified with respect to the best one of the candidate subspaces is higher than the percentages specified for each of the other candidate subspaces; accessing a classification rule that references at least one of the subspaces including the best one of the candidate subspaces to define the classification rule; dynamically modifying the classification rule using local optimization applied using the distributional data; accessing transactional data representing a pending transaction on process; and classifying the pending transaction based on the modified classification rule and the transactional data.