A method for rationalization of data used to model a time-variant behavior provides advantages in that storage requirements for such data are reduced and accuracy of detection of events in the behavior is increased. The method uses labels added to training data to indicate whether that data relates to recent events or not. A classifier is generated from the labelled training data. By removing old data which the classifier would classify differently were the old data re-labelled as new, a selective purging of the old training data takes place each time new training data becomes available. The method is especially useful in detecting fraudulent use of, or faults in, a communications network.