Abstract: There is provided a method for detecting an anomaly in plurality of data streams originating from a system or network of systems. Data streams are collected from the system or systems and divided into a plurality of time intervals. For each of the plurality of time intervals, a value for a parameter associated with the data stream is determined. A deviation in the determined values is calculated for the parameters associated with the data stream from expected values for the parameters and, if the calculated deviation is above a threshold, an anomaly is detected in the collected data stream.