A computer-implemented method comprising storing one or more generic machine operating definitions, wherein a generic machine operating definition of the one or more generic machine operating definitions describes expected operational behavior of a machine type of a plurality of machine types during one or more operating states; wherein the plurality of machine types include a type of machine system, a type of machine unit, a type of machine component, and a type of machine sensor associated with a machine of a plurality of machines; wherein the generic machine operating definition describing the expected operational behavior of the plurality of machine types incorporates a plurality of sub-definitions describing operating behavior for sub-elements of a set of elements that is described by a primary generic machine operating definition, wherein the generic machine operating definition incorporates causal relationships between different sub-definitions of the plurality of sub-definitions; analyzing past operating data (502A, 502B) that describes past operation of each machine of the plurality of machines; characterized in that based at least in part on the past operating data (502A, 502B) and the one or more generic machine operating definitions, generating and storing one or more machine operating models (306, 508A, 508B) that describe expected operational behavior corresponding to a plurality of operating states of the plurality of machines; wherein the one or more machine operating models (306, 508A, 508B) comprise data patterns and a set of corresponding labels, wherein each of the data patterns is associated with a different set of operating states of one or more machines of the plurality of machines; and applying the one or more machine operating models (306, 508A, 508B) to new operating data of each machine of the plurality of machines to characterize current operational behavior or determine expected future operational behavior of a system comprising the plurality of machines. storing one or more generic machine operating definitions, wherein a generic machine operating definition of the one or more generic machine operating definitions describes expected operational behavior of a machine type of a plurality of machine types during one or more operating states; wherein the plurality of machine types include a type of machine system, a type of machine unit, a type of machine component, and a type of machine sensor associated with a machine of a plurality of machines; wherein the generic machine operating definition describing the expected operational behavior of the plurality of machine types incorporates a plurality of sub-definitions describing operating behavior for sub-elements of a set of elements that is described by a primary generic machine operating definition, wherein the generic machine operating definition incorporates causal relationships between different sub-definitions of the plurality of sub-definitions; analyzing past operating data (502A, 502B) that describes past operation of each machine of the plurality of machines; characterized in that based at least in part on the past operating data (502A, 502B) and the one or more generic machine operating definitions, generating and storing one or more machine operating models (306, 508A, 508B) that describe expected operational behavior corresponding to a plurality of operating states of the plurality of machines; wherein the one or more machine operating models (306, 508A, 508B) comprise data patterns and a set of corresponding labels, wherein each of the data patterns is associated with a different set of operating states of one or more machines of the plurality of machines; and applying the one or more machine operating models (306, 508A, 508B) to new operating data of each machine of the plurality of machines to characterize current operational behavior or determine expected future operational behavior of a system comprising the plurality of machines.