A computer-implemented method, comprising: obtaining a data structure represented by a decision tree, wherein the data structure represented by the decision tree is generated based on a plurality of training events, wherein each of the plurality of training events has a plurality of attributes, and wherein each of the plurality of attributes has an attribute value, wherein the decision tree comprises a plurality of event nodes comprising a root node, one or more non-leaf nodes, and one or more branches, and one or more leaf nodes, wherein each of the plurality of event nodes represents one of the plurality of attributes and one of a plurality of attribute values, wherein each of the one or more branches below a non-leaf node represents an attribute value of an attribute represented by the non-leaf node, wherein each of the plurality of attributes is associated with an importance level for detecting anomalies, wherein the one or more nodes are arranged in the decision tree based on the importance level of the plurality of attributes, wherein each of the one or more leaf nodes or the one or more non-leaf nodes is associated with a permutation of attribute values occurring in the plurality of training events for one or more of the plurality of attributes, wherein a non-leaf node of the decision tree that represents an attribute having a highest importance level is a root node of the decision tree; obtaining a to-be-scored event, wherein the to-be-scored event has one or more attributes of the plurality of attributes and one or more attribute values; determining a traversed path for the to-be-scored event by mapping the one or more attributes and the one or more attribute values of the to-be-scored event to the decision tree; computing an anomaly score of the to-be-scored event based on the traversed path; and determining whether the to-be-scored event is an anomalous event based on the anomaly score. obtaining a data structure represented by a decision tree, wherein the data structure represented by the decision tree is generated based on a plurality of training events, wherein each of the plurality of training events has a plurality of attributes, and wherein each of the plurality of attributes has an attribute value, wherein the decision tree comprises a plurality of event nodes comprising a root node, one or more non-leaf nodes, and one or more branches, and one or more leaf nodes, wherein each of the plurality of event nodes represents one of the plurality of attributes and one of a plurality of attribute values, wherein each of the one or more branches below a non-leaf node represents an attribute value of an attribute represented by the non-leaf node, wherein each of the plurality of attributes is associated with an importance level for detecting anomalies, wherein the one or more nodes are arranged in the decision tree based on the importance level of the plurality of attributes, wherein each of the one or more leaf nodes or the one or more non-leaf nodes is associated with a permutation of attribute values occurring in the plurality of training events for one or more of the plurality of attributes, wherein a non-leaf node of the decision tree that represents an attribute having a highest importance level is a root node of the decision tree; obtaining a to-be-scored event, wherein the to-be-scored event has one or more attributes of the plurality of attributes and one or more attribute values; determining a traversed path for the to-be-scored event by mapping the one or more attributes and the one or more attribute values of the to-be-scored event to the decision tree; computing an anomaly score of the to-be-scored event based on the traversed path; and determining whether the to-be-scored event is an anomalous event based on the anomaly score.