Abstract: A method for searching for abnormal sessions, the method may include (a) obtaining session metadata for each of session of a group of sessions; wherein a session metadata of a session is indicative of at least one session feature that represents activities of the session; (b) forming multiple chunks, whereas each chunk comprises session metadata regarding a portion of the group of sessions; (c) for each chunk, generating chunk-based clusters by applying an iterative clustering process on data points that represent session metadata of the chunk; (d) generating group-based clusters, based on the chunk-based clusters; (e) determining, based at least on the group-based clusters, user profiles and abnormal sessions.

Abstract: A method for searching for abnormal sessions, the method may include (a) obtaining session metadata for each of session of a group of sessions; wherein a session metadata of a session is indicative of at least one session feature that represents activities of the session; (b) forming multiple chunks, whereas each chunk comprises session metadata regarding a portion of the group of sessions; (c) for each chunk, generating chunk-based clusters by applying an iterative clustering process on data points that represent session metadata of the chunk; (d) generating group-based clusters, based on the chunk-based clusters; (e) determining, based at least on the group-based clusters, user profiles and abnormal sessions.