A method of detecting intrusions in a system under surveillance, wherein said intrusions are detected by analyzing events occurring during operation of said system under surveillance by matching said events against a knowledge base including information on events occurred during a learning phase, the method including the steps of: - recording, during said learning phase, temporal data related to said events occurred during said learning phase; - identifying, within said knowledge base, a stable part including a list of resources of said system under surveillance for which said temporal data indicate a level of use during said learning phase above at least one respective threshold of use; - identifying a dynamic part of said knowledge base as a list of resources of said system under surveillance for which said temporal data indicate use below at least one given threshold level of use during said learning phase; - discovering patterns that cover said dynamic part of the knowledge base; and - during said analyzing, searching for any resource used by said system under surveillance in said stable part of said knowledge base and, - i) if said resource is found in said stable part, performing an in-depth analysis by checking other monitored properties of the resource, - ii) if said resource is not found in said stable part, searching said resource with a regular-expression like match in said dynamic part by performing a pattern matching operation based on said patterns, and emitting an alert if said resource is not found to be covered by any of said patterns in said dynamic part of said knowledge base. - recording, during said learning phase, temporal data related to said events occurred during said learning phase; - identifying, within said knowledge base, a stable part including a list of resources of said system under surveillance for which said temporal data indicate a level of use during said learning phase above at least one respective threshold of use; - identifying a dynamic part of said knowledge base as a list of resources of said system under surveillance for which said temporal data indicate use below at least one given threshold level of use during said learning phase; - discovering patterns that cover said dynamic part of the knowledge base; and - during said analyzing, searching for any resource used by said system under surveillance in said stable part of said knowledge base and, - i) if said resource is found in said stable part, performing an in-depth analysis by checking other monitored properties of the resource, - ii) if said resource is not found in said stable part, searching said resource with a regular-expression like match in said dynamic part by performing a pattern matching operation based on said patterns, and emitting an alert if said resource is not found to be covered by any of said patterns in said dynamic part of said knowledge base. - i) if said resource is found in said stable part, performing an in-depth analysis by checking other monitored properties of the resource, - ii) if said resource is not found in said stable part, searching said resource with a regular-expression like match in said dynamic part by performing a pattern matching operation based on said patterns, and emitting an alert if said resource is not found to be covered by any of said patterns in said dynamic part of said knowledge base.