A computer implemented method of detecting abnormal behaviour of at least one entity of a group of entities, from groups of entities, of a computer system, the method arranged to be performed by a processing system, the method comprising: creating a model of normal behaviour of the at least one entity (U,D,A,N), wherein the model of normal behaviour of the at least one entity (U,D,A,N) was created based on knowledge of a normal behaviour of the at least one entity (U,D,A,N) and a normal behaviour of any group of entities, from groups of entities, to which the at least one entity (U,D,A,N) is deduced to belong; applying restrictions to the at least one entity (U,D,A,N) based on the model of normal behaviour; and determining, in accordance with the model of normal behaviour of the at least one entity (U,D,A,N), a parameter indicative of abnormal behaviour of the entity (U,D,A,N); wherein the step of applying restrictions to the at least one entity (U,D,A,N) is carried out when the parameter exceeds a threshold value and wherein the restrictions comprise at least one of blocking access to an internet address, removing permission to a network resource or removing permission to a local resource; wherein each of the groups of entities is generated by grouping a plurality of entities (U,D,A,N) of the computer system based on data associated with the plurality of entities (U,D,A,N) of the computer system; and wherein the grouping of the plurality of entities (U,D,A,N) of the computer system to generate the groups of entities is performed by spectral partitioning and wherein the grouping of entities identifies groups of people working together or closely connected to each other based on the network traffic data or metrics. creating a model of normal behaviour of the at least one entity (U,D,A,N), wherein the model of normal behaviour of the at least one entity (U,D,A,N) was created based on knowledge of a normal behaviour of the at least one entity (U,D,A,N) and a normal behaviour of any group of entities, from groups of entities, to which the at least one entity (U,D,A,N) is deduced to belong; applying restrictions to the at least one entity (U,D,A,N) based on the model of normal behaviour; and determining, in accordance with the model of normal behaviour of the at least one entity (U,D,A,N), a parameter indicative of abnormal behaviour of the entity (U,D,A,N); wherein the step of applying restrictions to the at least one entity (U,D,A,N) is carried out when the parameter exceeds a threshold value and wherein the restrictions comprise at least one of blocking access to an internet address, removing permission to a network resource or removing permission to a local resource; wherein each of the groups of entities is generated by grouping a plurality of entities (U,D,A,N) of the computer system based on data associated with the plurality of entities (U,D,A,N) of the computer system; and wherein the grouping of the plurality of entities (U,D,A,N) of the computer system to generate the groups of entities is performed by spectral partitioning and wherein the grouping of entities identifies groups of people working together or closely connected to each other based on the network traffic data or metrics.