Abstract: The present invention relates to a system and a method for sequential anomaly revealing in a computer network. A method comprises the steps of receiving a log-file on activities of a user in the computer network; optional evaluation of each state in a session in a quarantine mechanism; multiple criteria evaluation of states of not quarantined states of the sessions or multi-state sessions in a session evaluation mechanism; and building and updating individual and group models. The system comprises a sequential anomaly revealing platform connected to the data hub and configured to reveal sequential anomalies in signals received from the data. The sequential anomaly revealing platform further comprises session evaluation and anomaly detection mechanism, individual and group models building and updating mechanisms, and optional multi-state transformation module and a quarantine module.