A data processing method comprising: receiving network performance data for a computer network (160, 120, 122, 124); receiving, from an intrusion detection system, IDS, network anomaly data indicating a plurality of anomalies that have occurred in the computer network; based, at least in part, on the network performance data and the network anomaly data, generating feature data, wherein the feature data specifies information about transmissions of large files, a status of a packet retransmission rate, a status of a large files transfer count, a status of an email volume size, counts of undelivered communications, access failure information, and device failure information; for each anomaly of the plurality of anomalies, selecting, from the feature data, a minimal set of features comprising: information about transmissions of large files, a status of a packet retransmission rate, a status of a large files transfer count, a status of an email volume size, counts of undelivered communications, access failure information, and device failure information, that distinguishes the anomaly, in the plurality of anomalies, from non-anomalies and from any other anomalies in the plurality of anomalies, and creating a mapping of the anomaly to the minimal set of features; based at least in part on the mapping, generating explanation rules for the plurality of anomalies; for a particular anomaly of the plurality of anomalies, identifying (1070, 1080) a particular rule of the explanation rules that is associated with the particular anomaly, and generating explanation data for the particular anomaly based upon the particular rule; wherein the method is performed using one or more computing devices. receiving network performance data for a computer network (160, 120, 122, 124); receiving, from an intrusion detection system, IDS, network anomaly data indicating a plurality of anomalies that have occurred in the computer network; based, at least in part, on the network performance data and the network anomaly data, generating feature data, wherein the feature data specifies information about transmissions of large files, a status of a packet retransmission rate, a status of a large files transfer count, a status of an email volume size, counts of undelivered communications, access failure information, and device failure information; for each anomaly of the plurality of anomalies, selecting, from the feature data, a minimal set of features comprising: information about transmissions of large files, a status of a packet retransmission rate, a status of a large files transfer count, a status of an email volume size, counts of undelivered communications, access failure information, and device failure information, that distinguishes the anomaly, in the plurality of anomalies, from non-anomalies and from any other anomalies in the plurality of anomalies, and creating a mapping of the anomaly to the minimal set of features; based at least in part on the mapping, generating explanation rules for the plurality of anomalies; for a particular anomaly of the plurality of anomalies, identifying (1070, 1080) a particular rule of the explanation rules that is associated with the particular anomaly, and generating explanation data for the particular anomaly based upon the particular rule; wherein the method is performed using one or more computing devices.