23. The system of claim 20 , further comprising: means for converting at least some events occurring on said network into event window examples that are inputted into a classifier; and means for applying each of a plurality of functions in a function library to said events.
24. The system of claim 23 , further comprising: means for repeating said applying each of a plurality of functions step for a predetermined number of events to capture a window of events as a window example; and means for sequentially shifting said window down one event at a time until a final event within said database falls within said window.