Data from a monitoring system is analyzed for monitoring characteristics of a dynamic system. Characteristic data in respect of a dynamic system is monitored and provided with at least one known normal state. Characteristic data is received from a monitoring system and confirmation information from an operator when the dynamic system is in a known normal state. A normality model is derived including comprising data indicative of known normal states in response to received characteristic data and confirmation information. Future characteristic data is predicted from the normality model a difference function is provided indicating an acceptable difference between predicted and received characteristic data. Predicted characteristic data is compared with received characteristic data in conjunction with the difference function and an abnormality signal is produced if the difference exceeds the difference function.