1. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, the storage medium comprising stored instructions configured to cause a data processing apparatus to perform operations including: accessing distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables, wherein each of the transactional events is represented by data with respect to each of the variables, wherein the distributional data is organized with respect to multi-dimensional subspaces of the sample space, wherein: each of the transactional events is associated with one of the subspaces based on the respective representative observations; the distributional data specifies a number of the transactional events associated with each of the subspaces; the transactional events include multiple unauthorized transactions and multiple authorized transactions; and the distributional data further specifies, with respect to each of the subspaces, a percentage of the transactional events that are unauthorized transactions; accessing a classification rule that references at least one of the subspaces; modifying the classification rule using local optimization applied using the distributional data; accessing transactional data representing a pending transaction; and classifying the pending transaction based on the modified classification rule and the transactional data.