Background noise from relevant data sets, including for example over-the-counter sales data, absenteeism data, etc., is subtracted using a background estimation algorithm that outputs residual data. The effects of hypothetical anomalous events, such as a bio-terrorist attack, on the relevant data sets are modeled to create replica data. The replica data may be based on input from epidemiologists and various scenario templates including information on disease manifestation and other intelligence. The residual data and the replica data are then matched using a detector. Types of detectors include for example adaptive matched-filter detectors, change detectors and Bayesian Inference Networks. An alarm is triggered if a real anomalous event similar to a hypothetical anomalous event is detected. A Geographical Information System (GIS) may be used to display data from individual zip codes.