A computer-implemented system for detecting suspicious websites in proxy's data streams, comprising: a) a data collection and pre-processing module for: a.1) receiving data from proxy logs and transforming said data into temporal website sequences of fixed size, where each sequence is from a specific user; a.2) removing rare websites that appear only once; b) a training module being a neural network, for: b.1) receiving each said sequence and performing a training phase, during which each sequence corresponds to a user ID; b.2) generating a Long Short-Term Memory, LSTM, based language model for predicting the next website in said each sequence, said language model comprising the following layers in order: (i) a first embedding layer representing each user as an embedding vector; (ii) a dense layer; (iii) a second embedding layer proving embedding representation to the websites; (iv) a dropout layer that is used to drop part of LSTM weights; (v) a concatenate layer for merging output of the users and the website's models; and a plurality of dense layers for simplifying outputs of the model; c) an anomaly detection module for: c.1) receiving all the sequences and feeding said sequences into the trained model; c.2) for every sequence, providing, by said model, a probability score representing how probable the sequence is; c.3) classifying the sequence as suspicious if said score is above a specific threshold; and d) an alerting module having an alert-logic for outputting alerts based on the number of suspicious websites of a user and the number of websites that were blocked by the proxy. a) a data collection and pre-processing module for: a.1) receiving data from proxy logs and transforming said data into temporal website sequences of fixed size, where each sequence is from a specific user; a.2) removing rare websites that appear only once; a.1) receiving data from proxy logs and transforming said data into temporal website sequences of fixed size, where each sequence is from a specific user; a.2) removing rare websites that appear only once; b) a training module being a neural network, for: b.1) receiving each said sequence and performing a training phase, during which each sequence corresponds to a user ID; b.2) generating a Long Short-Term Memory, LSTM, based language model for predicting the next website in said each sequence, said language model comprising the following layers in order: (i) a first embedding layer representing each user as an embedding vector; (ii) a dense layer; (iii) a second embedding layer proving embedding representation to the websites; (iv) a dropout layer that is used to drop part of LSTM weights; (v) a concatenate layer for merging output of the users and the website's models; and a plurality of dense layers for simplifying outputs of the model; b.1) receiving each said sequence and performing a training phase, during which each sequence corresponds to a user ID; b.2) generating a Long Short-Term Memory, LSTM, based language model for predicting the next website in said each sequence, said language model comprising the following layers in order: (i) a first embedding layer representing each user as an embedding vector; (ii) a dense layer; (iii) a second embedding layer proving embedding representation to the websites; (iv) a dropout layer that is used to drop part of LSTM weights; (v) a concatenate layer for merging output of the users and the website's models; and a plurality of dense layers for simplifying outputs of the model; c) an anomaly detection module for: c.1) receiving all the sequences and feeding said sequences into the trained model; c.2) for every sequence, providing, by said model, a probability score representing how probable the sequence is; c.3) classifying the sequence as suspicious if said score is above a specific threshold; and c.1) receiving all the sequences and feeding said sequences into the trained model; c.2) for every sequence, providing, by said model, a probability score representing how probable the sequence is; c.3) classifying the sequence as suspicious if said score is above a specific threshold; and d) an alerting module having an alert-logic for outputting alerts based on the number of suspicious websites of a user and the number of websites that were blocked by the proxy.