A method for determining abnormal events in an IT network, for detecting intrusions into IT network flows, consisting of an unsupervised clustering of a plurality of technical objects ( o i) each constituting an event in the IT network, in order to obtain a partition ( Par) of these objects into a plurality of clusters ( C l) thereby providing the ability to analyse these objects in order to determine the incidence of abnormal events, with each technical object ( o i) being described by a quantitative variable ( v k) or by a qualitative variable ( v k), the quality of the partition ( Par) obtained being described by an indicator of quality of this partition ( Par), the method being performed by a device for determining abnormal events and including an initial step comprising of: - the creation of a set of clusters to be separated including one or more additional clusters composed of all of the technical objects ( o i), and an empty set of indivisible clusters; and - the calculation of a current indicator of quality ( Ic) corresponding to the quality indicator of the partition ( Par) obtained; and the method being characterised in that it includes the following steps: - the separation of a selected cluster ( C s) within the set of clusters to be separated into two intermediate clusters C 1 ′ C 2 ′ and the calculation of a subsequent indicator of quality ( Is) corresponding to the quality indicator of the partition obtained; - if the subsequent indicator of quality ( Is) is greater than the current quality indicator ( Ic), the addition of the two intermediate clusters C 1 ′ C 2 ′ into the set of clusters to be separated; - otherwise in the contrary case: + for each cluster ( C l) in the set of indivisible clusters, the calculation of the indicator of quality ( I l) of a partition ( Par) obtained after the merging of this cluster ( C l) with the selected cluster ( C s); + the calculation of a maximum indicator ( Imax) from among all the calculated quality indicators ( I l); + if the maximum indicator of quality ( Imax) is greater than the current indicator of quality ( Ic), the addition of the merged cluster corresponding to this maximum indicator of quality, into the set of clusters to be separated; + otherwise in the contrary case, the addition of the selected cluster ( C s) into the set of indivisible clusters; the method further including a step of searching for abnormal events in each partition ( Par) obtained, consisting of associating a level of abnormality for each cluster ( C l) of the partition ( Par) obtained, the abnormal events being contained in each cluster ( C l) with a level of abnormality that is higher than a predetermined threshold of abnormality; at least certain abnormal events correspond to intrusions into IT network flows; each event being a memorized event such as: - the connection of a user to a given computer; - the duration or frequency of this connection that is greater than a predetermined threshold; - the total size of packets exchanged that is greater than a predetermined threshold or indeed other events. - the creation of a set of clusters to be separated including one or more additional clusters composed of all of the technical objects ( o i), and an empty set of indivisible clusters; and - the calculation of a current indicator of quality ( Ic) corresponding to the quality indicator of the partition ( Par) obtained; - the separation of a selected cluster ( C s) within the set of clusters to be separated into two intermediate clusters C 1 ′ C 2 ′ and the calculation of a subsequent indicator of quality ( Is) corresponding to the quality indicator of the partition obtained; - if the subsequent indicator of quality ( Is) is greater than the current quality indicator ( Ic), the addition of the two intermediate clusters C 1 ′ C 2 ′ into the set of clusters to be separated; - otherwise in the contrary case: + for each cluster ( C l) in the set of indivisible clusters, the calculation of the indicator of quality ( I l) of a partition ( Par) obtained after the merging of this cluster ( C l) with the selected cluster ( C s); + the calculation of a maximum indicator ( Imax) from among all the calculated quality indicators ( I l); + if the maximum indicator of quality ( Imax) is greater than the current indicator of quality ( Ic), the addition of the merged cluster corresponding to this maximum indicator of quality, into the set of clusters to be separated; + otherwise in the contrary case, the addition of the selected cluster ( C s) into the set of indivisible clusters; + for each cluster ( C l) in the set of indivisible clusters, the calculation of the indicator of quality ( I l) of a partition ( Par) obtained after the merging of this cluster ( C l) with the selected cluster ( C s); + the calculation of a maximum indicator ( Imax) from among all the calculated quality indicators ( I l); + if the maximum indicator of quality ( Imax) is greater than the current indicator of quality ( Ic), the addition of the merged cluster corresponding to this maximum indicator of quality, into the set of clusters to be separated; + otherwise in the contrary case, the addition of the selected cluster ( C s) into the set of indivisible clusters; - the connection of a user to a given computer; - the duration or frequency of this connection that is greater than a predetermined threshold; - the total size of packets exchanged that is greater than a predetermined threshold or indeed other events.