A method includes providing a columnar database comprising a plurality of columnar data structures associated with one column attribute; providing first data records having a plurality of first attribute-value pairs comprising counting information indicative of a number of first data records having the respective first attribute-value pair; providing mask data structures comprising one or more second attribute-value pairs; selecting second data records by intersecting the columnar data structures and the mask data structures; selecting one of the column attributes and one value contained in the column data structure associated with said selected column attribute as the destination attribute-value pair; creating one second rule for each first attribute-value pair; calculating, for each second rule, a co-occurrence-count between its respective source attribute-value pair and its destination attribute-value pair; and specifically selecting one or more of said second rules as the first rules in dependence on the calculated co-occurrence-count.