1. A system comprising: a processor; and memory comprising instructions that, when executed by the processor, cause the processor to perform operations comprising: receiving a flow record of a data flow, receiving a packet alert generated for a data packet, the packet alert generated based on a packet-level rule, determining a time when the packet alert associated with the data packet was generated, determining that the time when the packet alert associated with the data packet was generated occurred between a start time and an end time of the data flow, in response to determining that the time when the packet alert associated with the data packet was generated occurred between the start time and the end time of the data flow, associating the packet alert with the data flow, attributing, to the packet-level rule, a score in a form of a weighted sum Σ k w k p k (x) over flow level predicates p k (x), and in response to the score exceeding a threshold, constructing a flow-level rule that, when applied to the data flow, generates an alarm associated with the data flow.