CYBER SECURITY METHOD FOR DETECTING AN ANOMALY BASED ON UNSUPERVISED LEARNING

摘要

Disclosed herein is a method for use in detection of abnormal behaviour of a group of a plurality of entities (1,2,3,4,5) of a computer system (100). The method is arranged to be performed by a processing system and comprises: creating a model of normal behaviour of the group of entities (1,2,3,4,5); and determining, in accordance with the model of normal behaviour of the group of entities (1,2,3,4,5), a parameter indicative of abnormal behaviour of the group of entities (1,2,3,4,5). Also disclosed is an equivalent computer readable medium and anomalous behaviour detection system.