23. The system of claim 20 , further comprising: means for converting at least some events occurring on said network into event window examples that are inputted into a classifier; and means for applying each of a plurality of functions in a function library to said events.
23. The system of claim 20 , further comprising: means for converting at least some events occurring on said network into event window examples that are inputted into a classifier; and means for applying each of a plurality of functions in a function library to said events. 26. The system of claim 23 , wherein said means for labeling includes: means for enabling said system administrator to re-label select ones of said event window examples; and means for providing the re-labeled event window example to a theory refinement algorithm designed to determine which policy should be modified to correct classification of events according to the re-labeling of the select event window example.