13. The computer program product of claim 10 , further comprising program code for: converting at least some events occurring on said network into event window examples that are inputted into a classifier; and applying each of a plurality of functions in a function library to said events.
13. The computer program product of claim 10 , further comprising program code for: converting at least some events occurring on said network into event window examples that are inputted into a classifier; and applying each of a plurality of functions in a function library to said events. 16. The computer program product of claim 13 , wherein said program code for labeling includes program code for: enabling said system administrator to re-label select ones of said event window examples; and providing the re-labeled event window example to a theory refinement algorithm designed to determine which policy should be modified to correct classification of events according to the re-labeling of the select event window example.