A computer implemented method to detect anomalous behaviour of a software container having a software application executing therein, wherein the method comprises: receiving, during a training time period in which the software application is in normal usage absent malicious encumbrances, a sparse distributed representation of each of a: first set of container network traffic records; a first set of application traffic records; and a first set of container resource records, and training an hierarchical temporal memory, HTM, (320a, 320b, 320c) for each first set by executing each HTM in a training mode of operation based on the respective first set, wherein the container network traffic records correspond to network traffic communicated with the container, the application traffic records correspond to network traffic communicated with the software application, and the container resource records correspond to the use of computer resources by the container; receiving, during an operational time period distinct from the training time period, a sparse distributed representation of each of a: second set of container network traffic records; a second set of application traffic records; and a second set of container resource records; executing the trained HTMs based on each respective second set to determine a degree of recognition of each of the second sets; responsive to an identification of a coincidence of a degree of recognition of each of the second sets being below a threshold degree in each of the HTMs, identifying anomalous behaviour of the software container, wherein, in the training mode of operation during the training time period, each HTM evaluates an anomaly score for records in a respective first set of records and the HTM is trained until the anomaly score meets a predetermined threshold degree of anomaly. receiving, during a training time period in which the software application is in normal usage absent malicious encumbrances, a sparse distributed representation of each of a: first set of container network traffic records; a first set of application traffic records; and a first set of container resource records, and training an hierarchical temporal memory, HTM, (320a, 320b, 320c) for each first set by executing each HTM in a training mode of operation based on the respective first set, wherein the container network traffic records correspond to network traffic communicated with the container, the application traffic records correspond to network traffic communicated with the software application, and the container resource records correspond to the use of computer resources by the container; receiving, during an operational time period distinct from the training time period, a sparse distributed representation of each of a: second set of container network traffic records; a second set of application traffic records; and a second set of container resource records; executing the trained HTMs based on each respective second set to determine a degree of recognition of each of the second sets; responsive to an identification of a coincidence of a degree of recognition of each of the second sets being below a threshold degree in each of the HTMs, identifying anomalous behaviour of the software container, wherein, in the training mode of operation during the training time period, each HTM evaluates an anomaly score for records in a respective first set of records and the HTM is trained until the anomaly score meets a predetermined threshold degree of anomaly.