Methods, systems, and computer-readable storage media for predicting a type of an event in a computer-implemented system, implementations including receiving event data including a set of features representative of an event, determining a probability for at least one feature in the set of features from a data structure that stores a plurality of feature-probability pairs, the data structure representative of a type of event, providing a joint probability based on the probability of the at least one feature, the joint probability indicating a likelihood that the event is of the type of event, comparing the joint probability to a threshold to provide a comparison, and selectively executing one or more actions based on the comparison.