A computer implemented method of detecting anomalous behaviour in a set of computer systems communicating via a computer network, the method comprising: generating a baseline set of vector representations for each of a plurality of network communications occurring in the network during a baseline time period when the communications are absent malicious intervention, the vector representation being derived from a neural network trained using training data defined from the network communications; iteratively generating a runtime set of vector representations for each of a plurality of network communications occurring in the network during subsequent runtime time periods; applying a clustering algorithm to each of the baseline and runtime sets of vector representations to define each of a baseline and a runtime set of clusters of vector representations; determining a level of activity of each computer system during the baseline time periods, the level of activity being determined according to a sum of differences of vector representations for the computer system between sub-periods of the baseline time period; for each of the computer systems, determining anomalous behaviour responsive to any of: a) an evaluation of a measure of difference between the baseline and runtime vector representations for the computer system exceeding a threshold level of difference; b) an evaluation of a change of cluster membership of a vector representation for the computer system between the baseline and runtime sets of clusters; c) an evaluation of a membership of a vector representation for the computer system in a runtime set of clusters; and d) an evaluation of a difference in a level of activity of the computer system between the baseline and the runtime time periods, and responsive to the determination of anomalous behaviour, implementing one or more protective measures for the computer network. generating a baseline set of vector representations for each of a plurality of network communications occurring in the network during a baseline time period when the communications are absent malicious intervention, the vector representation being derived from a neural network trained using training data defined from the network communications; iteratively generating a runtime set of vector representations for each of a plurality of network communications occurring in the network during subsequent runtime time periods; applying a clustering algorithm to each of the baseline and runtime sets of vector representations to define each of a baseline and a runtime set of clusters of vector representations; determining a level of activity of each computer system during the baseline time periods, the level of activity being determined according to a sum of differences of vector representations for the computer system between sub-periods of the baseline time period; for each of the computer systems, determining anomalous behaviour responsive to any of: a) an evaluation of a measure of difference between the baseline and runtime vector representations for the computer system exceeding a threshold level of difference; b) an evaluation of a change of cluster membership of a vector representation for the computer system between the baseline and runtime sets of clusters; c) an evaluation of a membership of a vector representation for the computer system in a runtime set of clusters; and d) an evaluation of a difference in a level of activity of the computer system between the baseline and the runtime time periods, and a) an evaluation of a measure of difference between the baseline and runtime vector representations for the computer system exceeding a threshold level of difference; b) an evaluation of a change of cluster membership of a vector representation for the computer system between the baseline and runtime sets of clusters; c) an evaluation of a membership of a vector representation for the computer system in a runtime set of clusters; and d) an evaluation of a difference in a level of activity of the computer system between the baseline and the runtime time periods, and responsive to the determination of anomalous behaviour, implementing one or more protective measures for the computer network.