A method of monitoring states of operation of assets in a computer network , the method comprising: identifying a target asset of the computer network; establishing a communication link with a computing device (211-215) of the computer network associated with the target asset; transmitting, via the communication link, a plurality of sequential profiling queries to the computing device according to a hierarchical profiling scheme defining a plurality of profiling steps, each profiling step of the plurality of profiling steps associated with a corresponding profiling query that includes a corresponding set of parameters to be requested, the corresponding set of parameters associated with corresponding criteria or threshold values, wherein details of information requested via the plurality of sequential profiling queries increases from one profiling step to a subsequent profiling step, and incremental information requested in one profiling step depends on information acquired in a previous profiling step of the plurality of profiling steps; receiving, at each profiling step via the communication link, a respective set of parameter values corresponding to the set of parameters in the profiling query associated with the profiling step; comparing, at each profiling step, the respective set of parameter values to the criteria or threshold values associated with the corresponding set of parameters in the corresponding profiling query to determine a following profiling step or a state of operation of the target asset; and determining the state of operation of the target asset based on comparing a set of parameter values associated with a final profiling query of the plurality of sequential profiling queries to corresponding criteria or threshold values, the state of operation indicative of an abnormal behavior associated with the target asset and the final profiling query associated with a last profiling step of the plurality of profiling steps. identifying a target asset of the computer network; establishing a communication link with a computing device (211-215) of the computer network associated with the target asset; transmitting, via the communication link, a plurality of sequential profiling queries to the computing device according to a hierarchical profiling scheme defining a plurality of profiling steps, each profiling step of the plurality of profiling steps associated with a corresponding profiling query that includes a corresponding set of parameters to be requested, the corresponding set of parameters associated with corresponding criteria or threshold values, wherein details of information requested via the plurality of sequential profiling queries increases from one profiling step to a subsequent profiling step, and incremental information requested in one profiling step depends on information acquired in a previous profiling step of the plurality of profiling steps; receiving, at each profiling step via the communication link, a respective set of parameter values corresponding to the set of parameters in the profiling query associated with the profiling step; comparing, at each profiling step, the respective set of parameter values to the criteria or threshold values associated with the corresponding set of parameters in the corresponding profiling query to determine a following profiling step or a state of operation of the target asset; and determining the state of operation of the target asset based on comparing a set of parameter values associated with a final profiling query of the plurality of sequential profiling queries to corresponding criteria or threshold values, the state of operation indicative of an abnormal behavior associated with the target asset and the final profiling query associated with a last profiling step of the plurality of profiling steps. <EOS>