An improved empirical model-based surveillance or control system for monitoring or controlling a process or machine provides adaptation of the empirical model in response to new operational states that are deemed normal or non-exceptional for the process or machine. An adaptation decision module differentiates process or sensor upset requiring alerts from new operational states not yet modeled. A retraining module updates the empirical model to incorporate the new states, and a pruning technique optionally maintains the empirical model by removing older states in favor of the added new states recognized by the model.