1. A method for detecting abnormal user behavior for a query session of an electronic search engine through determining clickstream data by tracking user click activities associates with a search results page generating in response to a user search request including a search term, the method comprising: determining a conformance score for the clickstream data based on existing clickstream data for one or more similar query sessions, normalizing the conformance score to generate a normalized conformance value based on an event count for the query session; mapping the clickstream characteristics onto a probability score using univariate or multivariate models and comparing the probability score with the probability scores for the one or more similar query sessions to determine if the query session is abnormal.