A data processing method comprising: receiving network performance data for a computer network ; receiving , from an intrusion detection system , IDS, network anomaly data indicating a plurality of anomalies that have occurred in the computer network; based, at least in part, on the network performance data and the network anomaly data, generating feature data, wherein the feature data specifies information about transmissions of large files, a status of a packet retransmission rate, a status of a large files transfer count , a status of an email volume size , counts of undelivered communications, access failure information , and device failure information; for each anomaly of the plurality of anomalies, selecting , from the feature data, a minimal set of features comprising: information about transmissions of large files, a status of a packet retransmission rate, a status of a large files transfer count, a status of an email volume size, counts of undelivered communications, access failure information, and device failure information, that distinguishes the anomaly, in the plurality of anomalies, from non-anomalies and from any other anomalies in the plurality of anomalies, and creating a mapping of the anomaly to the minimal set of features; based at least in part on the mapping, generating explanation rules for the plurality of anomalies; for a particular anomaly of the plurality of anomalies, identifying a particular rule of the explanation rules that is associated with the particular anomaly, and generating explanation data for the particular anomaly based upon the particular rule; wherein the method is performed using one or more computing devices . receiving network performance data for a computer network ; receiving , from an intrusion detection system , IDS, network anomaly data indicating a plurality of anomalies that have occurred in the computer network; based, at least in part, on the network performance data and the network anomaly data, generating feature data, wherein the feature data specifies information about transmissions of large files, a status of a packet retransmission rate, a status of a large files transfer count , a status of an email volume size , counts of undelivered communications, access failure information , and device failure information; for each anomaly of the plurality of anomalies, selecting , from the feature data, a minimal set of features comprising: information about transmissions of large files, a status of a packet retransmission rate, a status of a large files transfer count, a status of an email volume size, counts of undelivered communications, access failure information, and device failure information, that distinguishes the anomaly, in the plurality of anomalies, from non-anomalies and from any other anomalies in the plurality of anomalies, and creating a mapping of the anomaly to the minimal set of features; based at least in part on the mapping, generating explanation rules for the plurality of anomalies; for a particular anomaly of the plurality of anomalies, identifying a particular rule of the explanation rules that is associated with the particular anomaly, and generating explanation data for the particular anomaly based upon the particular rule; wherein the method is performed using one or more computing devices . <EOS>