An anomaly detection method for a packet-based network, the packet-based network comprising several network resources, the method comprising: • monitoring the network resources of the packet-based network; • ordering the monitored network resources according to a given ordering criterion based on a respective amount of data traffic generated or received by each monitored network resource; and • detecting an anomaly in the packet-based network based on the ordered network resources, wherein detecting an anomaly includes: • forming a detection feature vector comprising detection feature items related to corresponding monitored network resources, and arranged in the detection feature vector depending on the ordering of the corresponding monitored network resources; and • feeding the detection feature vector to a one-class support vector machine configured to detect an anomaly in the packet-based network based on the detection feature vector, the method further including: • training the one-class support vector machine during a training period, said training period being a substantially free-of-attacks and free-of-failures time period; wherein training the one-class support vector machine includes: • monitoring and ordering the network resources during the training period, ordering being according to the given ordering criterion; • forming respective training feature vectors based on the network resources monitored and ordered during the training period, each training feature vector comprising respective training feature items which are related to corresponding network resources monitored and ordered during the training period, and are arranged in the training feature vector depending on the ordering of the corresponding network resources monitored and ordered during the training period; and • training the one-class support vector machine based on the training feature vectors. • monitoring the network resources of the packet-based network; • ordering the monitored network resources according to a given ordering criterion based on a respective amount of data traffic generated or received by each monitored network resource; and • detecting an anomaly in the packet-based network based on the ordered network resources, • forming a detection feature vector comprising detection feature items related to corresponding monitored network resources, and arranged in the detection feature vector depending on the ordering of the corresponding monitored network resources; and • feeding the detection feature vector to a one-class support vector machine configured to detect an anomaly in the packet-based network based on the detection feature vector, • training the one-class support vector machine during a training period, said training period being a substantially free-of-attacks and free-of-failures time period; • monitoring and ordering the network resources during the training period, ordering being according to the given ordering criterion; • forming respective training feature vectors based on the network resources monitored and ordered during the training period, each training feature vector comprising respective training feature items which are related to corresponding network resources monitored and ordered during the training period, and are arranged in the training feature vector depending on the ordering of the corresponding network resources monitored and ordered during the training period; and • training the one-class support vector machine based on the training feature vectors.