Method for intrusion detection to detect malicious insider threat activities within a network of multiple interconnected computerized user profiles, the method being performed by a system, wherein each user profile is defined by a set of user profile data, wherein the user profile data of a user profile are configured to identify the respective user profile within an organization structure of the network of the multiple interconnected user profiles, wherein for each user profile multiple sets of activity data are available, wherein each set of activity data of a user profile is configured to illustrate the activity of the user profile for a particular date during a predefined time span, wherein the network further comprises a further user profile, wherein the further user profile is defined by a set of further user profile data, wherein the further user profile data of the further user profile are configured to identify the further user profile within the organization structure of the network of the multiple interconnected user profiles (203, 204), and the method being characterized in that for the further user profile no sets of activity data are available, and by comprising the following method steps: - Training a neural network on multiple sets of user profile data for multiple user profiles and on multiple sets of activity data of the multiple user profiles of the network, such that the Neural Network is capable of predicting for future dates activities for multiple user profiles, - Applying the trained neural network on the set of further user profile data of the further user profile, - Predicting an activity of the further user profile for a future date based on the multiple sets of activity data by the trained neural network, - Observing the activity of the further user profile at the future date, - Applying the trained neural network on the observed activity of the further user profile at the future date, and - Detecting malicious activity for the further user profile at the future date by the trained neural network, if the observed activity of the further user profile at the future date deviates from the predicted activity of the further user profile for the future date. - Training a neural network on multiple sets of user profile data for multiple user profiles and on multiple sets of activity data of the multiple user profiles of the network, such that the Neural Network is capable of predicting for future dates activities for multiple user profiles, - Applying the trained neural network on the set of further user profile data of the further user profile, - Predicting an activity of the further user profile for a future date based on the multiple sets of activity data by the trained neural network, - Observing the activity of the further user profile at the future date, - Applying the trained neural network on the observed activity of the further user profile at the future date, and - Detecting malicious activity for the further user profile at the future date by the trained neural network, if the observed activity of the further user profile at the future date deviates from the predicted activity of the further user profile for the future date.