Method for designing a signature generator for providing a signature of an entity performing actions in a computing infrastructure, this signature being provided from a set of statistical characteristics of dated actions of this entity in the computing infrastructure, the method being computer-implemented and comprising: - obtaining a trainable machine comprising at least: • an upstream neural network for providing a signature of an entity from a set of statistical characteristics of dated actions of this entity in a computing infrastructure, and • a classifier for providing an entity prediction (E*) from the signature provided by the upstream neural network; - obtaining training data comprising sets of statistical characteristics of dated actions, each associated with an entity having performed these actions in the computing infrastructure, the training data comprising a plurality of sets of statistical characteristics for each entity; - supervised training of the trainable machine based on the training data so that the trainable machine correctly predicts the entities associated with the sets of statistical characteristics of the training data by using a first loss function (L ID) representative of a distance between each entity prediction (E*) and the associated entity; and - providing the signature generator comprising the upstream neural network after training; the method being characterized in that the supervised training is further performed in such a way that the trainable machine groups the signatures of each of the entities associated with the sets of statistical characteristics of the training data around a center associated with this entity by using a second loss function (L C) representative for each entity of a distance between its signatures and the center associated with it, the method further comprising detecting a threat in this computing infrastructure by using the signature of an entity to detect abnormal behavior of said entity. - obtaining a trainable machine comprising at least: • an upstream neural network for providing a signature of an entity from a set of statistical characteristics of dated actions of this entity in a computing infrastructure, and • a classifier for providing an entity prediction (E*) from the signature provided by the upstream neural network; • an upstream neural network for providing a signature of an entity from a set of statistical characteristics of dated actions of this entity in a computing infrastructure, and • a classifier for providing an entity prediction (E*) from the signature provided by the upstream neural network; - obtaining training data comprising sets of statistical characteristics of dated actions, each associated with an entity having performed these actions in the computing infrastructure, the training data comprising a plurality of sets of statistical characteristics for each entity; - supervised training of the trainable machine based on the training data so that the trainable machine correctly predicts the entities associated with the sets of statistical characteristics of the training data by using a first loss function (L ID) representative of a distance between each entity prediction (E*) and the associated entity; and - providing the signature generator comprising the upstream neural network after training; the method being characterized in that the supervised training is further performed in such a way that the trainable machine groups the signatures of each of the entities associated with the sets of statistical characteristics of the training data around a center associated with this entity by using a second loss function (L C) representative for each entity of a distance between its signatures and the center associated with it, the method further comprising detecting a threat in this computing infrastructure by using the signature of an entity to detect abnormal behavior of said entity.