1. A method comprising: training, using a computing device, a classifier using a set of transactions, each of the transactions comprising a set of literals, wherein a subset of the literals are literals representing discrete values, and wherein a first subset of the transactions represent a set of fraudulent transactions, and a second subset of the transactions represent a set of genuine transactions, wherein the classifier is trained to classify transactions presented to the classifier in a class selected from a list comprising fraud and genuine; clustering, using the computing device, the set of transactions on at least one of literals in each of the transactions such that each of the transactions assigned to one of a set of clusters; generating, using the computing device, a set of prototype transactions, wherein each of the set of clusters is used to generate a prototype transaction such that the respective prototype transaction represents a centroid of all transactions in the cluster; expanding, using the computing device, the discrete literals in each of the prototype transactions, wherein each expanded literal comprises a conjunction of all values of the respective discrete literal for which the prototype transaction is classified as fraud by the classifier; and generating, using the computing device, for each prototype transaction, a rule comprising a conjunction of the expanded discrete literals in the respective prototype transaction.