Model-based Rule Generation For Anomaly Detection