A method and apparatus for predicting significant future events based on previous events. Plural messages representing events are received. Attributes of the messages are mapped to respective feature dimensions to define a multidimensional histogram. Co-occurrence of at least two event types are determined based on queries of the multidimensional histogram. Anomalous event types are detected from the messages by comparing feature dimensions of incoming messages to probability density functions of the cluster corresponding to the event type and highly anomalous event types are determined. Causal relationships between each pair of event types are determined and a Bayesian belief network of the pairs of event types is created and used to predict future events based on occurrence of additional events.