Methods, systems and software are described for analyzing micro-blog messages to detect abnormal activity of interest. The system includes a clusterer for clustering micro-blog messages received over a first period of time, a classifier for scoring the clustered messages; a knowledge base, a rule generator for generating classification rules from the knowledge base; and a matcher for matching the scored messages to information requests. Methods for operating the system and its components are described.