A method for generating transaction data from network traffic data for an application system which is distributed across a plurality of network connected nodes, comprising: gathering the network traffic data, the network traffic data including syntactic information; storing the network traffic data and the syntactic information in field-sets; deriving semantic information from the network traffic data and the syntactic information with a first module which implements a first semantic model relating to first transactions, and modifying the field-sets to include the semantic information; passing the field-sets to a second module; deriving additional semantic information from the network traffic data, the syntactic information, and the semantic information with the second module which implements a second semantic model relating to second transactions, and further modifying the field-sets to include the additional semantic information; and, outputting the field-sets from the second module to provide the transaction data for the application system.