A method for detecting emergent abnormal behavior in a computer network, comprising: identifying an outbound communication from a source device of the computer network to a destination device outside of the computer network; collecting as event information, trace data from the outbound communication and process data from the source device; calculating an abnormality score for the outbound communication based on the trace data and the process data; calculating an incident score; comparing the calculated incident score against an incident threshold; and in response to the calculated incident score satisfying the incident threshold, providing a security alert related to the outbound communication, characterized in that calculating the abnormality score comprises selecting at least two feature pairs from the trace data and the process data, each feature pair including a first feature and a second feature; determining for each feature pair a probability, based on the other outbound communications directed to the same destination device, of seeing the first feature when the second feature is present in the outbound communication; and aggregating the probability determined for each feature pair to produce the abnormality score; the method further comprises aggregating the calculated abnormality score for the outbound communication according to the destination device with abnormality scores for other outbound communications directed to the same destination device to produce an aggregated abnormality score for a behavior surrounding the outbound communication; and the incident score is calculated in association with the aggregated abnormality score for the behavior based on how widespread the behavior is within the computer network. identifying an outbound communication from a source device of the computer network to a destination device outside of the computer network; collecting as event information, trace data from the outbound communication and process data from the source device; calculating an abnormality score for the outbound communication based on the trace data and the process data; calculating an incident score; comparing the calculated incident score against an incident threshold; and in response to the calculated incident score satisfying the incident threshold, providing a security alert related to the outbound communication, characterized in that calculating the abnormality score comprises selecting at least two feature pairs from the trace data and the process data, each feature pair including a first feature and a second feature; determining for each feature pair a probability, based on the other outbound communications directed to the same destination device, of seeing the first feature when the second feature is present in the outbound communication; and aggregating the probability determined for each feature pair to produce the abnormality score; the method further comprises aggregating the calculated abnormality score for the outbound communication according to the destination device with abnormality scores for other outbound communications directed to the same destination device to produce an aggregated abnormality score for a behavior surrounding the outbound communication; and the incident score is calculated in association with the aggregated abnormality score for the behavior based on how widespread the behavior is within the computer network.